Sub-processor change notifications
Under Section 5.1 of our Data Processing Agreement, we give advance notice before adding or replacing a sub-processor. This page is the dated, public record of those changes. The full current list, with each provider's country of operation and transfer mechanism, lives in Annex III.
Get notified automatically
- RSS: subscribe to /dpa/sub-processors/rss.xml in any feed reader or monitoring tool to be notified whenever this page changes — the most reliable way to get advance notice.
- Email: we may also email the address registered on your account, and will do so where we reasonably consider a change to be material.
AI-assisted spam evaluation
Static Forms uses TypeSafe AI (Jev), through Vercel AI Gateway, to evaluate form submissions for spam. We plan to extend availability across all customer accounts, regardless of selected data-residency region, following the DPA notice and objection process. This describes the planned rollout; processing is not necessarily enabled for every account yet. It is separate from the optional AI reply feature.
Requests contain selected, length-limited form fields and, where available, the form website hostname. We filter fields identified as sensitive and redact recognized credentials, email addresses and certain number patterns. Redaction does not make free-text submissions anonymous: personal data can remain. Attachment contents and request IP addresses are not included in this evaluation payload.
Requests use the Gateway's zero-data-retention and no-prompt-training controls. Provider obligations and exceptions are governed by the applicable provider agreements; see TypeSafe's Data Processing Addendum, Vercel's DPA and Vercel's AI Product Terms. Vercel documents Jev's support for these controls in its Jev announcement. These references do not replace Static Forms' obligations under our DPA.
Static Forms separately stores evaluation results and selected redacted input samples in AWS us-east-1 for spam-quality review. These records are scheduled to expire within 15 days, or earlier where the source submission's retention requires it; database expiry deletion is asynchronous. Account, form and submission deletion also removes associated evaluation records. This storage is separate from the providers' retention controls.
You have the right to object to a new sub-processor on reasonable data-protection grounds within 14 days of notice. To raise an objection, contact info@staticforms.dev.
TypeSafe AI (Jev) disclosed for AI-assisted spam evaluation
Our sub-processor disclosures now include TypeSafe AI (Jev), accessed through Vercel AI Gateway for AI-assisted spam evaluation. We plan to extend availability across all customer accounts, regardless of selected data-residency region, including EU accounts. This notice covers the planned expansion and does not mean processing is already enabled for every account. AI evaluation may involve processing outside the selected storage region. Expansion follows the DPA notice and objection process; the DPA and transfer assessment describe current processing scope. Selected, redacted form fields and the form website hostname may be processed; personal data can remain in free text. Requests use Gateway zero-data-retention and no-prompt-training controls. Static Forms separately stores evaluation results and selected redacted input samples with expiry scheduled within 15 days; database deletion is asynchronous. Provider terms: https://typesafe.ai/legal/data-processing and https://vercel.com/legal/ai-product-terms. Customers may object on reasonable data-protection grounds within 14 days of notice by emailing info@staticforms.dev. See the DPA and Annex III for details.
EU data residency: AWS eu-central-1 (Frankfurt) added as a storage location
Accounts can now select European Union data residency when they sign up. For those accounts, form data — submissions, file attachments, webhook delivery logs and AI reply logs — is stored in AWS eu-central-1 (Frankfurt) rather than us-east-1. No new sub-processor is engaged: AWS is an existing sub-processor and this notice records an additional storage location for it. The scope is storage of form data only. For every account, whichever region it selects, account data and billing remain in the United States, transactional email continues to be delivered from AWS SES in the United States with Singapore as failover, and operational request logs (request metadata and field names, never field values) continue to be stored with Axiom in the United States. Annex III, Section 8 of the DPA and the Transfer Impact Assessment have been updated accordingly.
AI reply sub-processors disclosed: Vercel AI Gateway, OpenAI and Anthropic (alongside Google)
AI reply generation (an optional, per-form feature) is routed through the Vercel AI Gateway under a zero-data-retention configuration, and the underlying model may be provided by Google, OpenAI, or Anthropic (all United States). Newly configured accounts now default to Google Gemini; some existing accounts already use OpenAI or Anthropic models, and this notice brings the disclosure into line with that. MiniMax and any other China-based model provider are not used. Annex III and Section 5 of the DPA have been updated accordingly.
Sub-processor list expanded with countries of operation and transfer mechanisms
Published Annex III listing each sub-processor with its country of operation and the transfer safeguard that applies (EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework), and added processor-to-processor (agency) coverage under SCC Module 3. No new sub-processor was added; this entry documents the expanded disclosure.
Initial sub-processor list published
First published list of the sub-processors we engage to deliver Static Forms, covering cloud infrastructure and storage, transactional email delivery, spam filtering, product analytics, error monitoring, and payment processing.
