Sub-processor change notifications
Under Section 5.1 of our Data Processing Agreement, we give advance notice before adding or replacing a sub-processor. This page is the dated, public record of those changes. The full current list, with each provider's country of operation and transfer mechanism, lives in Annex III.
Get notified automatically
- RSS: subscribe to /dpa/sub-processors/rss.xml in any feed reader or monitoring tool to be notified whenever this page changes — the most reliable way to get advance notice.
- Email: we may also email the address registered on your account, and will do so where we reasonably consider a change to be material.
You have the right to object to a new sub-processor on reasonable data-protection grounds within 14 days of notice. To raise an objection, contact info@staticforms.dev.
EU data residency: AWS eu-central-1 (Frankfurt) added as a storage location
Accounts can now select European Union data residency when they sign up. For those accounts, form data — submissions, file attachments, webhook delivery logs and AI reply logs — is stored in AWS eu-central-1 (Frankfurt) rather than us-east-1. No new sub-processor is engaged: AWS is an existing sub-processor and this notice records an additional storage location for it. The scope is storage of form data only. For every account, whichever region it selects, account data and billing remain in the United States, transactional email continues to be delivered from AWS SES in the United States with Singapore as failover, and operational request logs (request metadata and field names, never field values) continue to be stored with Axiom in the United States. Annex III, Section 8 of the DPA and the Transfer Impact Assessment have been updated accordingly.
AI reply sub-processors disclosed: Vercel AI Gateway, OpenAI and Anthropic (alongside Google)
AI reply generation (an optional, per-form feature) is routed through the Vercel AI Gateway under a zero-data-retention configuration, and the underlying model may be provided by Google, OpenAI, or Anthropic (all United States). Newly configured accounts now default to Google Gemini; some existing accounts already use OpenAI or Anthropic models, and this notice brings the disclosure into line with that. MiniMax and any other China-based model provider are not used. Annex III and Section 5 of the DPA have been updated accordingly.
Sub-processor list expanded with countries of operation and transfer mechanisms
Published Annex III listing each sub-processor with its country of operation and the transfer safeguard that applies (EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework), and added processor-to-processor (agency) coverage under SCC Module 3. No new sub-processor was added; this entry documents the expanded disclosure.
Initial sub-processor list published
First published list of the sub-processors we engage to deliver Static Forms, covering cloud infrastructure and storage, transactional email delivery, spam filtering, product analytics, error monitoring, and payment processing.