Trust & Security
Effective 25 July 2026
This is the live reference for who processes data on our behalf and how we protect it — the subprocessor list our Data Processing Agreement (Annex III) and Privacy Policy point to. We add subprocessors here, and give advance notice, before any new one touches tenant data.
Active subprocessors
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Railway Corp. | Compute (web + worker), managed PostgreSQL, Redis, volumes | All platform data (tenant brand data, campaign content, member emails, audit logs) | EU (europe-west4, Amsterdam) |
| Anthropic PBC | AI generation and review (Claude API) | Tenant brand data and campaign content in prompts — never end-customer personal data | US, under Anthropic’s DPA + EU Standard Contractual Clauses |
| Resend Inc. | Transactional email (magic-link sign-in, invitations) | Member email addresses, sign-in links | EU sending region (Ireland) for the verified onscreen.io domain |
Planned (added before they touch tenant data)
| Subprocessor | Purpose | Added when |
|---|---|---|
| Cloudflare R2 (or EU S3-compatible) | Object storage for brand assets and raw ingestion payloads | Storage migration off the application volume |
| Sentry (EU instance) | Error tracking (redacted events, correlation IDs only) | Observability hardening |
| Meta Platforms, Google | Advertising and analytics API integrations (read metrics; later publishing) | Each provider connector as it ships — see our Integrations page |
Security measures
- Tenant isolation, defense in depth: every tenant-scoped table carries a workspace id with PostgreSQL row-level security in FORCE mode; application services connect under dedicated non-superuser database roles; a two-workspace isolation test suite runs on every code change.
- EU data residency: production compute and databases run in the EU (Amsterdam); transactional email sends from an EU region. AI processing is the one exception (Anthropic, US) — under Standard Contractual Clauses, and end-customer personal data is never included in AI prompts.
- Encryption: TLS in transit; provider-managed encryption at rest; integration credentials (e.g. ad-platform connections) are envelope-encrypted and bound to the specific workspace and connection.
- Access control: server-side permission checks on every action; a full audit log; database-backed sessions that can be revoked instantly.
- Backup and recovery: point-in-time recovery plus scheduled backups, with a tested restore procedure — target recovery point ≤ 15 minutes, recovery time ≤ 4 hours.
- Logging hygiene: structured logs with redaction — no prompt content, credentials or sign-in links are ever logged.
More
See our Privacy Policy and data deletion instructions. Questions: hello@onscreen.io.