Subprocessors
To run InterMIND we use a small set of infrastructure and service providers ("subprocessors"). This page lists each one, what it processes, where, and under what safeguards. Service Operator and Contracting Entity: Golden Fish LLC (UAE). Publisher and Intellectual Property Owner: MindMeeting OÜ (EE).
Processing happens in the EU by default. Where a provider's corporate entity is outside the EU/EEA, transfers are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework (DPF). DPF participation below was last verified against the official DPF registry on 2026-09-01. We update this list whenever a subprocessor is added or removed.
| Subprocessor | Entity domicile | Purpose | Personal data processed | Processing location | Safeguards |
|---|---|---|---|---|---|
| Vercel Inc. | US | Web app hosting, serverless functions, AI Gateway (proxy) | All app traffic incl. meeting metadata, chat | Functions pinned to Frankfurt (fra1); AI Gateway has a zero-data-retention policy (no prompt retention) | DPA + SCCs; DPF; ZDR |
| Fly.io Inc. | US | Realtime WebSocket server hosting | Chat fan-out, conference events, transcription words in transit | Paris (CDG) | DPA + SCCs; DPF |
| Neon Inc. | US | Postgres (primary database) | Accounts, meetings, messages, transcripts, billing usage | Frankfurt (AWS eu-central-1) | DPA + SCCs; DPF (covered entity of Databricks, Inc.); encryption at rest |
| Tigris Data Inc. | US | Object storage | Meeting recordings, chat attachments, documents, export archives | EU multi-region (Frankfurt + Amsterdam) | DPA + SCCs; TLS |
| MindMeeting OÜ (Mind API) | EE | Meeting media (SFU), speech recognition, realtime translation | Audio/video streams, speech, participant names/roles | OVH, France | Intra-group agreement |
| DeepL SE | DE | Document translation | Contents of documents users submit for translation | EU (Cologne) | DPA; no retention for training |
| Stripe Payments Europe Ltd / Stripe Inc. | IE / US | Billing | Name, email, billing address, payment method (card never touches InterMIND) | EU / US | DPA + SCCs; DPF; PCI-DSS |
| PostHog | US (EU Cloud) | Product analytics, session replay | Usage events, console/replay (consent-gated, opt-out by default; meeting speech scrubbed from logs) | EU (eu.posthog.com) | DPA; DPF; EU residency |
| Functional Software Inc. (Sentry) | US (EU region) | Error monitoring | Error traces, breadcrumbs (no meeting content) | EU (de.sentry.io) | DPA; DPF; EU residency |
| Resend | US | Transactional email (sign-in codes, notifications) and inbound email ingest (in.intermind.com receiving domain) | Recipient email, message content; inbound: full email bodies and attachments | Ireland (eu-west-1) | DPA + SCCs; DPF |
| Upstash Inc. | US | OIDC session cache (Redis) | Encrypted session/token cache | Frankfurt (fra1) | DPA + SCCs; DPF; encrypted payloads |
| Pipedrive OÜ | EE | Sales CRM (contact / partner forms) | Lead name, email, company, message | EU | DPA |
| Paddle.com Market Ltd | UK | Billing (Merchant of Record in selected countries) | Name, email, billing address, payment method (card never touches InterMIND), plan/team references, buyer country | UK | DPA; UK adequacy decision; PCI-DSS |
| Cloudflare Inc. | US | Bot protection on public forms (Turnstile challenge) | Challenge token, implicit visitor signals (IP, browser characteristics) | Global edge network | DPA + SCCs; DPF |
| Usercentrics GmbH | DE | Consent management (cookie/consent banner) | Consent choices, consent ID | EU | DPA; EU processing |
| Expo (650 Industries, Inc.) | US | Mobile push notifications and app updates | Push tokens, notification content (message text truncated to 120 characters), device metadata | US | DPA + SCCs; DPF |
| Microsoft Corp. (Azure OpenAI, Azure AI Speech) | EU | AI features: meeting recaps, document summaries, writing assistant, support assistant, Ask AI, and Mia's voice in meetings (text to speech); voice-note speech-to-text | Meeting transcript and chat window (at meeting end), shared documents, editor text, help-chat questions; voice-note audio (once, at upload) | EU Data Zone (processing and storage within EU member states); our own tenant | Microsoft Products and Services DPA; EU Data Boundary; no training on customer data |
| Google LLC (Vertex AI, Cloud Text-to-Speech) | EU | AI features (only for organizations that select Vertex AI as their AI gateway): meeting recaps, document summaries, writing assistant, support assistant, Ask AI, and Mia's voice in meetings (text to speech) | Meeting transcript and chat window (at meeting end), shared documents, editor text, help-chat questions | EU multi-region endpoint (ML processing within the EU); our own project | Google Cloud Data Processing Addendum; no training on customer data; zero data retention for Gemini on Vertex (abuse-logging off) |
| Google LLC / Microsoft Corp. | US | OAuth sign-in; user-authorized calendar sync, file sharing (Drive / OneDrive), and organization directory sync | Name, email, profile photo; with user-granted scopes: calendar events incl. attendee emails, shared-file permissions, org user directory (names, emails) | US | DPF; SCCs |
For questions about this list or to request a copy of the relevant transfer safeguards, contact privacy@intermind.com.