Subtitle AI
Legal & compliance

Sub-processors

The companies that process your media, transcripts or personal data for us, what each one receives, and where.

Last updated
24 September 2026
Download PDF

Current sub-processors

  • Amazon Web Services

    Amazon Web Services EMEA SARL, Luxembourg

    Stores your files and runs our processing: preview copies, waveforms, thumbnails, transcription and subtitle jobs, and video rendering. Delivers files to your browser through Amazon CloudFront.

    What it receives
    Your uploaded media and everything produced from it.
    Where
    EU (Paris, France). CloudFront can briefly cache a file at the edge location nearest the person viewing it.
    Transfer safeguard
    AWS Data Processing Addendum, including the Standard Contractual Clauses, for edge caching outside the EEA.

  • MongoDB Atlas

    MongoDB Limited, Ireland

    Our database.

    What it receives
    Transcripts, subtitles, translations, project and file names, and account details.
    Where
    EU (Paris, France)

  • Vercel

    Vercel Inc., United States

    Hosts the web application. Its server functions handle every request the editor makes.

    What it receives
    Content passing through the application while you use it, account details and IP addresses.
    Where
    EU (Paris, France) for server functions. Static pages are served from Vercel’s global network.
    Transfer safeguard
    Standard Contractual Clauses

  • Soniox

    Soniox, Inc., United States

    Speech recognition: turns the audio in your file into a transcript. Our primary provider.

    What it receives
    Your audio or video file, which it fetches from our storage, and your custom vocabulary.
    Where
    EU, through Soniox’s EU endpoint: audio and transcripts are processed and stored in the EU.
    Transfer safeguard
    Standard Contractual Clauses, for the service metadata Soniox may process outside the EEA

  • ElevenLabs

    Eleven Labs Inc., United States

    Backup speech recognition, used only when Soniox is unavailable and the file is under 1 GB.

    What it receives
    Your audio or video file and your custom vocabulary.
    Where
    United States for now. We are moving it to ElevenLabs’ EU data residency environment.
    Transfer safeguard
    EU-U.S. Data Privacy Framework

  • Speechmatics

    Cantab Research Limited, United Kingdom

    Backup speech recognition for files of 1 GB or more, used only when Soniox is unavailable.

    What it receives
    Your audio or video file and your custom vocabulary.
    Where
    EU
    Transfer safeguard
    UK adequacy decision, for access from the United Kingdom

  • Google Gemini API

    Google LLC, United States

    Language models that lay out subtitles, translate them, and write chapters and highlights.

    What it receives
    Transcript text with timings and speaker labels, and any instructions you add, such as tone of voice. Never your audio or video.
    Where
    Not fixed: Google may process requests in any of its data centres.
    Transfer safeguard
    EU-U.S. Data Privacy Framework, and Google’s data processing terms with the Standard Contractual Clauses

  • Resend

    Plus Five Five, Inc., United States

    Sends account and notification emails.

    What it receives
    Your email address, and the project names and links in notification emails.
    Where
    United States
    Transfer safeguard
    Standard Contractual Clauses

  • PostHog

    PostHog Inc., United States

    Product analytics: which features are used, linked to a pseudonymous user ID.

    What it receives
    Usage events from the application, which can include the text of on-screen elements you click, such as a line of a transcript.
    Where
    EU (Frankfurt, Germany)
    Transfer safeguard
    Standard Contractual Clauses, for access from the United States

What every sub-processor has agreed to

Each sub-processor may use your content only to perform its task for us. None of them may use it to train or improve their models. Where one processes data outside the European Economic Area, the transfer is covered by an adequacy decision, such as the EU-U.S. Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses.

Changes to this list

We give at least 30 days’ notice before a new sub-processor starts processing your data: we update this page and email the owner of each account. Under our Data Processing Agreement you can object to the change.

Providers we use for our own purposes

A few providers help us run the business rather than process your content. Stripe handles payments, and Google Analytics measures visits to our website. Cloudflare Turnstile blocks automated sign-ups, and Upstash applies rate limits to sign-in attempts. They do not receive your media or transcripts. Our Privacy Policy covers this processing.

Questions about any provider? Email privacy@subtitle.ai.