Subprocessors
Every third party that may process customer data, what they do, and where.
Last updated September 1, 2026
In plain English
These are the companies that help us run the product. Each one has a specific job and a contract that forbids using your content for anything else — including training models. We give you thirty days' notice before this list changes.
DemoRiff engages the sub-processors below to provide the Service. Each is bound by a written agreement containing data protection obligations no less protective than our own, including a prohibition on using Customer Content for model training or any purpose other than providing the contracted service.
Infrastructure
| Sub-processor | Function | Location |
|---|---|---|
| Amazon Web Services | Primary compute, object storage, managed databases | US, EU (Ireland, Frankfurt), AU (Sydney) |
| Google Cloud Platform | GPU render capacity, overflow compute | US, EU (Belgium) |
| Cloudflare | CDN, DDoS protection, edge delivery of published assets | Global edge |
| Fastly | Video segment delivery | Global edge |
Processing and inference
| Sub-processor | Function | Location |
|---|---|---|
| Anthropic | Script analysis, rewriting and the Riff co-editor | US, EU |
| Deepgram | Speech recognition and word-level alignment | US, EU |
| ElevenLabs | Speech synthesis and voice cloning | US, EU |
| Replicate | Presenter rendering and lip-sync models | US |
Zero retention
Every inference sub-processor above operates under a zero-retention agreement: Customer Content is not stored after the inference call returns, and is never used for training or evaluation.
Business operations
| Sub-processor | Function | Location |
|---|---|---|
| Stripe | Payment processing and invoicing | US, EU |
| WorkOS | SAML SSO and SCIM directory sync | US, EU |
| Zendesk | Customer support ticketing | US, EU |
| Resend | Transactional email delivery | US, EU |
| Datadog | Application monitoring and error reporting | US, EU |
Regional restriction
Customers on Scale and Enterprise may pin processing to a single region, in which case only sub-processors operating in that region are used. Enterprise customers running private rendering in their own cloud do not use the infrastructure or inference sub-processors for media processing at all — only the control plane sub-processors apply.
Change notification
Subscribe to changes at legal@demoriff.com. We give at least thirty days' notice before adding or replacing a sub-processor, and Enterprise customers have a contractual right to object.