Docdrift is operated by Un martes a las 10 am, S.A. de C.V. ("we"). These are the companies that process personal data for us to run Docdrift. The list is part of our Data Processing Agreement and our Privacy Policy.
"Customer Data" is what you and your team put into Docdrift or connect to it, and what Docdrift derives from it for you. "Account Data" is what we need to run your account and bill you. The Privacy Policy explains both.
Subprocessors
| Company | What it does for Docdrift | Data it processes | Where | Safeguard for transfers |
|---|---|---|---|---|
| Google LLC (Google Cloud Vertex AI) | AI analysis | Customer Data sent for analysis: code excerpts and diffs, doc statements, requests and questions. Vertex AI is configured with zero data retention: data caching is off, and Google doesn't use this data to train models | European Union | Processed in the EU. Google Cloud Data Processing Addendum with Standard Contractual Clauses |
| Hetzner Online GmbH | Servers, database and daily server images | All Customer Data and Account Data we store | Germany | Processed in the EU. Hetzner data processing agreement |
| Cloudflare, Inc. | DNS, content delivery and TLS for docdrift.io and app.docdrift.io; bot protection at sign-up (Turnstile); file storage (R2) for exports and encrypted database backups | Traffic to our website and app, including code excerpts you open in the app, which Cloudflare decrypts in its network; IP addresses; exports; encrypted backups | Global network, including the United States; R2 storage (exports and backups) in the European Union | Cloudflare Data Processing Addendum with Standard Contractual Clauses and the UK Addendum |
| Backblaze, Inc. | Encrypted mirror of our database backups. We start using it when we turn the mirror on | Encrypted database backups | European Union (Netherlands) | Processed in the EU. Backblaze Data Processing Addendum |
| Resend (Plus Five Five, Inc.) | Sending Docdrift's emails | Recipient email addresses and names; email content, which can include project, finding and capability names but never code excerpts. Resend keeps sent emails for 30 days | United States | Resend Data Processing Agreement with Standard Contractual Clauses |
| Stripe, Inc. and its affiliates | Payments, subscriptions, invoices and tax calculation | Account Data only: billing name, email, address, tax ID and payment details. Stripe collects card details directly; we never see full card numbers | United States and other countries | Stripe Data Processing Agreement with Standard Contractual Clauses. For some payment data, such as fraud prevention, Stripe acts as an independent controller under its own privacy policy |
Services you connect
These services aren't our subprocessors. You use them under your own agreement with them, and Docdrift reads from or writes to them only because you connected them and only within the permissions you granted.
| Service | What Docdrift does with it |
|---|---|
| GitHub | Reads the repositories you install the Docdrift app on, publishes checks and one comment per pull request, and, only if you install Docdrift Write, opens pull requests and issues you approve. Signing in with GitHub is optional |
| Notion | Reads the pages you share with Docdrift and edits them only when a person approves the change |
| Reads the Google Docs you pick, with access limited to those files. See our Google API disclosure | |
| Anthropic (Claude) and OpenAI (ChatGPT) | If you connect Docdrift to your chat assistant, it receives the answers you ask for, under your own account with that provider. They don't process data for Docdrift |
Changes to this list
We update this page at least 30 days before a new subprocessor starts processing Customer Data, and we email the Owner of each workspace. If you object on reasonable data protection grounds, tell us at [email protected] within those 30 days. If we can't address your objection, you can delete your workspace before the change takes effect, as the Data Processing Agreement explains. We may replace a subprocessor sooner in an emergency, such as a security incident or a provider shutting down; then we tell you as soon as we can.