English
Deutsch Subprocessor List
Last updated: January 2, 2026
Overview
This page lists the subprocessors that Murmurd uses to provide our Service. Subprocessors are third-party service providers that process personal data on our behalf.
We will update this list when we add or remove subprocessors. Material changes will be notified to customers at least 30 days in advance via email.
Current Subprocessors
Infrastructure & Hosting
| Subprocessor | Purpose | Data Location | DPA |
|---|---|---|---|
| Railway | Application hosting, database | EU (Frankfurt) | DPA |
| Cloudflare, Inc. | CDN, DDoS protection, R2 storage (avatars) | Global (EU-preferred) | DPA |
| Upstash | Redis (rate limiting, caching) | EU (Frankfurt) | DPA |
Payment Processing
| Subprocessor | Purpose | Data Location | DPA |
|---|---|---|---|
| Stripe, Inc. | Payment processing, billing | US/EU | DPA |
Communication
| Subprocessor | Purpose | Data Location | DPA |
|---|---|---|---|
| Mailgun (Sinch) | Transactional email delivery | EU | DPA |
| Slack Technologies | Messaging integration | US | DPA |
Authentication & Identity
| Subprocessor | Purpose | Data Location | DPA |
|---|---|---|---|
| Google LLC | OAuth authentication | US | DPA |
| Okta, Inc. | SSO/SCIM provisioning (enterprise) | US | DPA |
AI Processing
| Subprocessor | Purpose | Data Location | DPA |
|---|---|---|---|
| OpenAI, Inc. | AI summary generation | US | DPA |
| Anthropic | AI summary generation | US | DPA |
| Google LLC | AI summary generation (Gemini) | US | DPA |
| Mistral AI | AI summary generation | EU (France) | DPA |
Data Processing Details
What Data is Shared
Each subprocessor only receives the minimum data necessary for their function:
- Railway/Cloudflare: All application data (encrypted at rest)
- Stripe: Organization billing info, subscription data
- Mailgun: Email addresses, notification content
- Slack: User Slack IDs, message content for integrations
- Google/Okta: Authentication tokens, user identifiers
- AI Providers: Check-in responses, priorities, escalations (for summary generation only)
Security Measures
All subprocessors are bound by:
- Data Processing Agreements (DPAs) compliant with GDPR
- Standard Contractual Clauses (SCCs) for international transfers
- Technical and organizational security measures
- Confidentiality obligations
AI Data Handling
For AI summary generation:
- Data is not used for model training
- Processing is ephemeral (no long-term storage by AI providers)
- Confidential items are excluded from AI processing
- Organizations can choose EU-based Mistral AI for GDPR preference
Changes to Subprocessors
Notification Process
We notify customers of subprocessor changes through:
- Email to organization administrators
- Update to this page
- 30-day advance notice before new subprocessor activation
Objection Rights
If you object to a new subprocessor, you may:
- Contact us within 30 days of notification
- Discuss alternatives or accommodations
- Terminate your account if no resolution is reached
Contact
For questions about our subprocessors:
- Email: privacy@murmurd.com
- DPO: dpo@murmurd.com
Last reviewed: January 2, 2026