Stelaah

Subprocessors

To deliver the Services we use a small number of trusted third parties, or "subprocessors". This page lists them and explains how we manage and notify changes.

Last updated October 9, 2026 · Version 2.1 Contact legal
Few, vetted, and contracted. Every subprocessor is bound by terms no less protective than our DPA, may only process data on our instructions, and must report security incidents to us.
Contents and legal documents

This page lists the subprocessors that may process Customer Personal Data in connection with the Services, as referenced in our Data Processing Addendum. We keep the list current and notify customers of changes as described below.

1How we choose and manage subprocessors

Before engaging a subprocessor, we assess its security and privacy practices and enter into a written contract that imposes data protection obligations no less protective than those in our DPA. Subprocessors may process Customer Personal Data only to provide their service to us, only on our instructions, and must maintain appropriate security measures and report incidents to us. We remain responsible to you for their performance.

2Current subprocessors

The following third parties may process Customer Personal Data to provide the Services. Some, such as the AI providers and accounting sync, are used only when you use the related feature or connect the integration. Services you connect from your own account, such as Google Workspace, Microsoft 365 or Zoom, act under your agreement with that provider.

Subprocessor
Purpose
Primary region
Supabase
Managed Postgres database, authentication, object/file storage, and realtime: the core hosting and data layer for the Services.
Primary region: United States
Cloudflare
Delivery of the Stelaah app and website, storage of uploaded files and attachments, bot protection on sign-in forms, and video playback. AI model processing on Cloudflare Workers AI, using open models such as Kimi K2.6, Gemma, Llama, Whisper and Flux, for background briefs, document and image explanations, speech-to-text, the cloud voice, image generation and the Inventory assistant.
Primary region: Global network
Google LLC
Paid Gemini Developer API model processing for Aria, transcription, and AI image features. Google may process the prompt and system instructions, the workspace text or files selected for the request, the generated response, and limited safety and operational metadata. Stelaah does not use unpaid Gemini API services for Customer Content.
Primary region: United States / global
Google Analytics
Consent-gated measurement on the public marketing website, only after a visitor grants Analytics consent. Advertising personalization is disabled. Not used inside the Stelaah app.
Primary region: United States / global
Resend
Delivery of transactional and notification emails, such as sign-in, receipts, and workspace alerts, and receipt of email sent to Stelaah addresses.
Primary region: United States / EU
Stripe
Payment processing for subscriptions and invoices. Card data is handled by Stripe; we do not store full card numbers.
Primary region: United States / global
Intuit (QuickBooks)
Optional accounting synchronization, used only if you connect QuickBooks to your workspace.
Primary region: United States

3Infrastructure and hosting

Our core infrastructure, meaning database, authentication, file storage, and realtime, runs on managed cloud infrastructure operated by our hosting subprocessor, which in turn relies on certified underlying cloud data centers for physical security.

4Notification of changes

When we add or replace a subprocessor that processes Customer Personal Data, we will update this page and, at least 30 days before the new subprocessor begins processing, notify customers who have subscribed to subprocessor change notices. To subscribe, email privacy@stelaah.com.

5Objecting to a change

If you have a reasonable, data protection related objection to a new subprocessor, tell us within the notice period and we will work in good faith to address it. If we cannot, you may, as your sole remedy, terminate the affected Services as described in the DPA.

6Contact

Questions about our subprocessors? Email privacy@stelaah.com.

Questions about this policy? Email legal@stelaah.com.

Back to top
Processing your workspace data.

The Data Processing Addendum sets out the terms every subprocessor is held to.

Read the DPA →