A Hebrew translation of this page is provided for convenience. If the versions differ, the English version prevails.
Subprocessors
Last updated: 2026-10-19
What is a subprocessor? A third-party vendor that we use to deliver StreamLive Pro and that may handle (process) your personal data on our behalf. Per GDPR Article 28 and our Privacy Policy we maintain this list and notify customers of material changes.
Cloud infrastructure
| Vendor | Purpose | Region | Data types | Compliance |
|---|---|---|---|---|
| StreamLive Pro application server (our own server, Hot-Net) | Runs the application: web app, API, media processing, temporary working files | Israel — Tel Aviv | All data processed by the app while in use; temporary media files | Operated by StreamLive Pro |
| Neon (Serverless Postgres) | Primary database — accounts, projects, streams, billing metadata | Germany — Frankfurt (AWS eu-central-1) | All persistent account / project / stream data & metadata | SOC 2 Type IIISO 27001GDPR DPA |
| Upstash (Serverless Redis) | Background job queue, rate limiting, caching, pub/sub | Germany — Frankfurt | Transient job payloads, rate-limit counters, cache keys | SOC 2 Type IIGDPR DPA |
| Cloudflare Inc. — CDN, DNS, WAF | CDN, DNS, DDoS protection, WAF, rate limiting, bot protection on sign-up (Turnstile) | Global edge | HTTP request metadata (IP, UA, headers), TLS termination | SOC 2 Type IIISO 27001PCI DSS |
| Cloudflare R2 | Object storage for recordings, uploads, exported clips, AI input/output cache | US / global | Recordings (video/audio), uploaded media, export files | SOC 2 Type IIISO 27001GDPR DPA |
| Cloudflare Stream | Live video ingest, simulcast to your destinations, recordings | US / global | Live video/audio streams, recordings, stream metadata | SOC 2 Type IIISO 27001GDPR DPA |
AI / Speech / Translation
| Vendor | Purpose | Region | Data types | Compliance |
|---|---|---|---|---|
| Groq Inc. | Speech-to-text (Whisper): transcription of uploaded media and clips, and live captions during broadcasts | US | Audio of the media you submit, or short live-audio windows (~5 s); transient, not used for training | GDPR DPA |
| Anthropic (Claude) | Translation and caption polishing, summaries, suggested titles, descriptions and clips, comment-reply drafts (only when you ask), Q&A in support chat | US | Text only (transcripts, captions, titles, a comment you select, support messages). API contract excludes content from training. | SOC 2 Type IIGDPR DPANo-train clause |
| Google Gemini API | Translation (Hebrew/Arabic/multilingual), checking transcripts against the audio, fallback for Claude | US | Transcripts and text; for transcript checks, the audio of the media you submit. Configured to opt out of training where supported. | ISO 27001SOC 2 Type IIGDPR DPA |
| OpenAI (Whisper, GPT) — fallback only, when configured | Optional automatic fallback for transcription/translation when Groq/Gemini are unavailable (inactive unless an OpenAI key is set) | US | Audio chunks (transient), transcribed text. API contract excludes content from training. | SOC 2 Type IIGDPR DPANo-train clause |
| Silero (local ONNX) | Voice Activity Detection for Whisper hole-fill — runs locally on our servers, NO data leaves our infrastructure | Local — on our server | None transmitted (on-device model) | N/A (local model) |
Billing & payments
| Vendor | Purpose | Region | Data types | Compliance |
|---|---|---|---|---|
| Cardcom Ltd. | Payment processing — card payments and recurring subscription charges | Israel | Card details are entered on Cardcom's secure payment page and never reach our servers. We receive only an encrypted token, the card's expiry date, its last 4 digits and brand, plus transaction records (amount, date, approval number). | PCI DSS |
| EZcount | Invoices and receipts (Israeli tax documents) | Israel | Name, email, billing details, amounts and invoice records | Israeli Privacy Protection Law |
Email & communications
| Vendor | Purpose | Region | Data types | Compliance |
|---|---|---|---|---|
| Resend | Transactional email (welcome, verification, password reset, DMCA notice, billing receipts) | US | Recipient email, message body, delivery metadata | SOC 2 Type IIGDPR DPA |
Monitoring
| Vendor | Purpose | Region | Data types | Compliance |
|---|---|---|---|---|
| Sentry.io | Server & client error monitoring (stack traces, request metadata) | EU — Germany (ingest.de.sentry.io) | Error stack traces, anonymized user ID. PII is scrubbed by SDK config. | SOC 2 Type IIISO 27001GDPR DPA |
Where your data is processed: Israel (application server, payment processing, invoicing), Germany (database, queue, error monitoring) and the United States (Cloudflare storage and video, AI, email).
Broadcast destinations (downstream)
When you connect a social account and broadcast, your stream is sent directly to that platform's RTMP / API. Once content reaches the platform, it is governed by their terms — they are independent controllers, not our subprocessors. We list them here for completeness.
| Platform | Region | Data sent | Their policy |
|---|---|---|---|
| YouTube / Google | US | OAuth token, stream payload, metadata | policies.google.com/privacy |
| Meta (Facebook, Instagram) | US | OAuth token, page selection, stream payload | facebook.com/privacy |
| TikTok | Global | OAuth token, video uploads, stream key | tiktok.com/legal/privacy-policy |
| Twitch | US | OAuth token, stream key, metadata | twitch.tv/p/legal/privacy-notice |
| Kick | Global | Stream key, metadata | kick.com/privacy-policy |
| X (Twitter) | US | OAuth token, posts, media uploads | twitter.com/privacy |
| US | OAuth token, posts, media uploads | linkedin.com/legal/privacy-policy | |
| Vimeo | US | OAuth token, video uploads, stream key | vimeo.com/privacy |
| Bluesky (Bluesky Social PBC) | US | Handle, App Password (encrypted), posts and media you publish | bsky.social/about/support/privacy-policy |
| Mastodon (the server you choose) | Varies | OAuth token, posts and media you publish | joinmastodon.org/privacy-policy |
| Discord | US | Webhook URL (encrypted), messages and files you publish | discord.com/privacy |
| US | OAuth token, Pins you publish | policy.pinterest.com/privacy-policy | |
| US | OAuth token, posts and media you publish | reddit.com/policies/privacy-policy | |
| Tumblr (Automattic) | US | OAuth token, posts and media you publish | tumblr.com/privacy |
| VK | Russia | OAuth token, posts and media you publish | vk.com/privacy |
| Slack (Salesforce) | US | Webhook URL (encrypted), messages you publish and live alerts | slack.com/trust/privacy |
| Telegram (Telegram FZ-LLC) | Global | Operational alerts to the StreamLive Pro team only: masked e-mail (ab***@gmail.com), country, plan and amount of sign-ups and subscriptions. Never names, card data or your content | telegram.org/privacy |
| Dailymotion | France | OAuth token, videos you publish | legal.dailymotion.com/en/privacy-policy |
Notifications of changes
We notify customers of material additions or removals to this list at least 30 days before they take effect, unless the change is required for security or legal compliance and must take effect sooner. Subscribe to changes by emailing [email protected] with the subject "Subscribe subprocessors".
Customers under an enterprise agreement may also request a signed Data Processing Addendum (DPA) referencing this list — contact [email protected].
Contact
- Data Protection Officer: [email protected]
- Legal: [email protected]
- GDPR data rights: /gdpr
- Trust Center: /trust
This page reflects sub-processors as of the date above. The current canonical list always lives at /subprocessors.