Legal
Sub-processors
Every third party that processes data on our behalf, what each one receives and where it runs. This page is the authoritative version.
Want to be told about changes?
Account holders are emailed 30 days before we add a sub-processor that touches meeting content. There is nothing to subscribe to.
Contents
Last updated
Current sub-processors
| Sub-processor | What they receive | Where |
|---|---|---|
| Deepgram | Meeting audio, for transcription | United States |
| OpenAI | Transcript text, for summaries and action items | United States |
| Cloudflare R2 | Recordings, transcripts and summaries | EU / global edge |
| MongoDB Atlas | Account data and meeting metadata | EU (Stockholm) |
| Fly.io | Running the application and the notetaker | EU (Stockholm) |
| Vercel | Serving this website | EU / global edge |
| Resend | Email addresses, for transactional email | EU / United States |
| Stripe | Billing name, address and card token | EU / United States |
| Calendar events, read-only | Global |
The two that matter most in a data protection review are the first two. Speech-to-text receives the full meeting audio, and summarisation receives the full transcript text. Both run in the United States, which is stated plainly on the privacy policy and the security page as well as here.
How changes are announced
We update this page before a change takes effect. For any sub-processor that touches meeting content we also email account holders 30 days ahead. If you object on reasonable data protection grounds within those 30 days, the data processing agreement lets you terminate the affected part of the service with a refund of the unused term.
What this list is for
A vendor that will not tell you who else touches your data has answered the question. This list exists so the answer sits on a public page rather than in a questionnaire, and so that the people in your meetings can read it too.
Questions about this document: privacy@neurtask.com. All documents are listed on the legal index.