Paperbeam, Inc.
Subprocessors
Last updated · Draft
These are the companies that help us run Paperbeam and may process customer data on our behalf. Each is bound by data protection terms at least as protective as our DPA.
Current subprocessors
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Web hosting and edge delivery | Request metadata; content in transit | United States (global edge) |
| Neon | Postgres database | Account data, derived facts, editions | United States |
| Cloudflare R2 | File storage | Evidence packs, audio, PDFs, images | United States |
| Railway | Background workers and page rendering | Content in processing; not stored | United States |
| Anthropic | AI model provider (zero data retention) | Source excerpts in prompts; not retained | United States |
| OpenAI | Text-to-speech and fallback models | Edition text; source excerpts on fallback | United States |
| ElevenLabs | Audio edition voices | Edition script text | United States |
| Resend | Email delivery | Recipient addresses, edition emails | United States |
| Stripe | Billing and payments | Billing contact, payment details | United States |
| Nango | Integration authorization and sync | OAuth tokens (encrypted), synced records | United States |
| PostHog | Product analytics | Usage events on our site and app; no edition content | United States |
| Sentry | Error monitoring | Error traces, scrubbed of content | United States |
AI model providers process content under zero-data-retention terms where available and never train on it. Business workspaces can restrict processing to zero-retention providers or bring their own model key, in which case that provider acts under the customer’s own agreement.
How we notify you of changes
- We give at least 30 days’ notice before a new subprocessor begins processing customer data, by email to workspace admins and by updating this page.
- To subscribe as a non-admin, email privacy@paperbeam.ai with the subject “Subprocessor updates”.
- You may object on reasonable data protection grounds during the notice period, as described in our DPA.
- In an emergency (for example, to keep the service running after a vendor failure) we may replace a subprocessor with shorter notice and will tell you as soon as possible.
Change history
October 5, 2026: initial list published.