Subprocessors
Every third party that processes data on ShareMyPage's behalf, what each one handles, and where it runs.
ShareMyPage uses a small number of third-party subprocessors to deliver the service. Each is bound by a data processing agreement. This list is the authoritative one, referenced by our DPA and the Privacy Policy.
How you find out when this changes
This page lives in the same repository as the product, so every change to it is a commit with a date and a diff, and material changes are noted in the changelog. Customers with an active DPA are notified directly, as clause 5 of the DPA requires.
Primary data region
Page content (Blob), the database (Postgres) and serverless compute run in the European Union (Frankfurt). Transactional email (France) and product analytics (Frankfurt) are also processed in the EU.
Authentication, payments and AI generation process data in the United States, covered by the EU Standard Contractual Clauses.
The list
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting, serverless compute, content (Blob) storage, cookieless web analytics, and the AI Gateway that routes model calls | Page HTML, application requests, AI prompts in transit | EU (fra1, Frankfurt) for Blob and compute; global CDN edge |
| Neon | Managed Postgres database | Page metadata, versions, folders, comments, tokens, audit log | EU (AWS eu-central-1, Frankfurt) |
| Anthropic | AI model inference for the deck features: generating a deck, editing a slide, changing a layout, and suggesting a theme | The slide or deck content and the instruction you submit | United States |
| Clerk | Authentication and identity (Google/Microsoft OAuth, organizations) | Name, email, workspace membership | United States |
| Upstash | Rate limiting (Redis) | Transient request counters, no content | Global edge, transient counters only |
| Stripe | Subscription billing and payments | Billing contact and payment metadata | United States / EU |
| Brevo | Transactional email (welcome, comment notifications, invitations) and the monthly product update | Recipient email, names, email content | EU (France) |
| PostHog | Product analytics and session replay (cookieless) | Pageviews, UI interaction events, approximate location from IP; never page content | EU (Frankfurt) |
Identity providers (Google, Microsoft) process authentication on your behalf when your users sign in. They are not subprocessors of your page content.
A note on the AI subprocessor
Anthropic is engaged only by the slide-deck AI features. Hosting, sharing, viewing and commenting on a page involve no model call at all, so content you never run an AI action on is never sent to a model provider.
One exception is worth knowing: importing a PowerPoint re-authors by default, and that sends each slide's parsed content to a model. Faithful mode imports the same file without any model call.
Which content is sent, and what happens to it, is covered in AI and your content.
See also
- For security reviewers: the full assessment document.
- Data Processing Agreement
- Privacy Policy