Compliance & Security
Last updated: August 2026 • Version 2.0
SiteMind works with specialized infrastructure partners to host our applications, compute vector embeddings, and process payments. Prior to engaging any subprocessor, we conduct thorough security reviews and enter into binding Data Processing Agreements incorporating standard data protection clauses.
| Subprocessor | Corporate Entity | Processing Purpose | Data Location | Transfer Safeguards |
|---|---|---|---|---|
| Google Cloud / Gemini API | Google LLC | AI conversational inference, semantic text chunk embeddings (gemini-embedding-001), and speech-to-text processing. | United States / Global | Commercial Enterprise Terms (Zero Model Training), EU Standard Contractual Clauses |
| Neon Database | Neon, Inc. | Managed serverless PostgreSQL database with pgvector extension for chunk indexing and application persistence. | London, United Kingdom (AWS eu-west-2) | UK / EEA Data Hosting, TLS in Transit, Disk Encryption at Rest |
| Render Cloud | Render Services, Inc. | API application compute, background BullMQ queue workers, and Redis key-value state store. | United States / European Union | EU Standard Contractual Clauses, TLS in Transit |
| Cloudflare | Cloudflare, Inc. | Edge DNS routing, DDoS protection, Web Application Firewall (WAF), Cloudflare R2 object storage for documents, and Browser Rendering. | Global Edge / United States | EU Standard Contractual Clauses, S3-Compatible Encrypted Storage |
| Vercel | Vercel, Inc. | Frontend web application hosting, Edge Middleware routing, and privacy-conscious Web Analytics. | Global Edge / United States | EU Standard Contractual Clauses, Consent-Gated Analytics |
| Polar.sh | Polar Software Inc. | Merchant of Record (MoR), checkout processing, subscription lifecycle management, and VAT/tax invoicing. | United States / European Union | PCI-DSS Compliant Infrastructure, Encrypted Payment Gateways |
| Resend | Resend, Inc. | Transactional email infrastructure for account verification, password resets, and system notifications. | United States | EU Standard Contractual Clauses, API Key Authentication |
| Sentry | Functional Software, Inc. | Application exception logging, real-time error alerts, and diagnostic performance tracing. | United States | EU Standard Contractual Clauses, Data Processing Addendum |
In accordance with our Data Processing Agreement (DPA), SiteMind will notify customers of any planned addition or replacement of a subprocessor at least 14 days in advance.
Customers may subscribe to subprocessor notifications or raise objections on legitimate data protection grounds by contacting [email protected].