Subprocessor List
Instrumento.io — Third-Party Subprocessors
Effective date: August 19, 2026 · Version 1.4.0
Updated 31 July 2026. This list has been corrected to reflect the providers currently used to deliver AI features. The previous version named only our original built-in AI transport and had not been updated as the underlying providers changed. Where a transfer mechanism or contractual confirmation is still being finalised, the entry says so rather than stating something we have not verified.
Overview
Instrumento.io engages the third-party subprocessors below to deliver the Service. We require each subprocessor to be bound by terms imposing data protection obligations consistent with our DPA; entries marked Under review are those where we are completing that confirmation.
We will provide at least 30 days' advance notice of any addition or replacement of a subprocessor by updating this page and notifying organization owners via email and in-app banner.
Infrastructure and Storage
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Render Services, Inc. | Application hosting — runs the Instrumento web service | All customer data, while requests are being served | United States | Under review |
| PingCAP, Inc. (TiDB Cloud) | Managed database service — stores all persisted customer data | All customer data: organisation and user records, datasets, forms and responses, surveys, dashboards, reports and their contents | United States (AWS us-west-2, Oregon) | Under review |
| Cloudflare, Inc. (R2) | Object storage — holds every file uploaded to the Service | Uploaded files: documents, images, audio and video recordings, organisation logos, generated report exports, and any personal data those files contain | United States (Eastern North America) | Under review |
| Amazon Web Services (AWS) | Underlying cloud on which the managed database service runs | The database contents, as the infrastructure beneath PingCAP's managed service | United States (us-west-2, Oregon) | SCCs (EU–US) / IDTA (UK) |
Note on the database. An earlier version of this page credited Amazon Web Services with database hosting. AWS provides the underlying cloud, but the managed database is operated by PingCAP, and it is PingCAP that processes the data held in it. This entry corrects that attribution; the arrangement itself has not changed.
Note on file storage. An earlier version of this page stated that uploaded files were held in Amazon S3. They are not, and have not been: uploaded files are stored in Cloudflare R2, in Cloudflare's Eastern North America region. This corrects an inaccurate attribution rather than announcing a change of provider — the storage arrangement itself is unchanged, and no new processing of your data has been introduced. AWS's role is now limited to the cloud underlying the database service.
Payment Processing
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management | Billing name, email, payment card metadata (last 4 digits), billing address | United States | SCCs (EU–US) / IDTA (UK) |
Authentication and Identity
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Google LLC | OAuth 2.0 sign-in (optional), Google Sheets integration | Name, email address, profile photo (if Google sign-in used); spreadsheet contents you choose to import | United States | SCCs (EU–US) / Adequacy decision (UK) |
Email and Communications
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Resend, Inc. | Transactional email delivery (account notifications, password resets, DSR notifications, subprocessor change alerts) | Email address, name, email content | United States | SCCs (EU–US) |
Artificial Intelligence
| Subprocessor | Purpose | Data Processed | Active when | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| Anthropic, PBC | Primary AI engine (Claude). Powers the Copilot, report drafting, form and survey generation, onboarding and Theory-of-Change assistance, dataset annotation and SROI guidance | Content you submit to an AI feature: dataset values, form and survey responses, interview transcripts, organisation profile and Theory-of-Change text, and your questions | Whenever an AI feature is used | United States | Under review |
| Voyage AI | Text embeddings used to retrieve relevant material from our knowledge base | Your query text, and the text of the knowledge-base documents we index | When knowledge-base retrieval is enabled | United States | Under review |
| OpenAI, L.L.C. | Speech-to-text transcription | Audio recordings you upload to voice features, and the resulting transcript | When voice features are used | United States | Under review |
| Manus AI | Legacy transport retained as a fallback for AI requests, speech-to-text and file storage proxying. Where it handles an AI request it selects the model provider, which is its own subprocessor rather than a direct recipient of your data | The same content as above, on that path | Only when the fallback transport is active | United States | SCCs (EU–US) |
How your data reaches AI providers
- Redaction. Content passes through a PII redaction layer before it leaves the Service. This is applied at the transport layer, so it covers every AI request rather than depending on individual features.
- Per-dataset and per-column controls. You can mark a dataset as unavailable to AI, or exclude individual columns. Excluded columns are withheld from AI features entirely — including dataset profiling, column annotation and automatically generated dashboards.
- Training. We do not submit customer data to these providers for model training.
- Voice. Transcription sends the recording itself, not only the resulting text. Organisations that do not use voice features generate no such transfers.
- Turning it off. AI access is controlled per dataset and per column, using the controls described above. There is no single organisation-wide switch that turns off all AI features.
Error Monitoring and Observability
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Sentry (Functional Software, Inc.) | Error tracking, performance monitoring | Error messages, stack traces, user identifiers (anonymized where possible), browser/OS metadata | United States | SCCs (EU–US) |
Change History
| Date | Change | Version |
|---|---|---|
| 2025-01-01 | Initial subprocessor list published | 1.0.0 |
| 2026-07-31 | Corrected the AI section, which had not kept pace with the providers actually in use. Added Anthropic (primary AI engine), Voyage AI (embeddings) and OpenAI (speech-to-text); restated Manus AI as a legacy fallback transport. Separated application hosting (Render) from cloud infrastructure (AWS). Removed an analytics entry that receives no data in the current product. Added detail on redaction, the per-dataset and per-column AI controls, and voice handling. Transfer mechanisms marked Under review are being confirmed. | 1.1.0 |
| 2026-08-03 | Named PingCAP, Inc. (TiDB Cloud) as the operator of the managed database holding all persisted customer data. The previous entry attributed database hosting to Amazon Web Services; AWS provides the underlying cloud, but PingCAP operates the service and processes the data. AWS is now scoped to object storage and that underlying infrastructure. This corrects an attribution — the arrangement itself is unchanged and no new provider was introduced. | 1.2.0 |
| 2026-08-04 | Corrected the "Turning it off" note, which said AI features could be disabled in organization settings. No such organisation-wide switch exists; AI access is controlled per dataset and per column, as the preceding note already described. No subprocessor was added, removed or changed. | 1.2.1 |
| 2026-08-19 | Corrected the database region. The PingCAP and AWS rows stated us-east-1; the production database runs in us-west-2 (Oregon), verified against the region of the TiDB Cloud cluster the production application connects to. This corrects an inaccurate location — the provider, the arrangement, and the country are unchanged, and no data moved. Data remains in the United States either way, so no transfer analysis changes. | 1.4.0 |
| 2026-08-08 | Corrected the object-storage entry. The page stated that uploaded files were held in Amazon S3 (us-east-1); they are in fact held in Cloudflare R2, in Cloudflare's Eastern North America region, and have been since file storage moved there. Added Cloudflare, Inc. as a named subprocessor and narrowed the AWS entry to the cloud underlying the managed database. This corrects an inaccurate attribution — the storage arrangement itself is unchanged and no new processing was introduced. Cloudflare's transfer mechanism is marked Under review pending confirmation. | 1.3.0 |
Objections
Customers may object to a new or replacement subprocessor within 30 days of notification. To object, email info@instrumento.io with the subject line "Subprocessor Objection — [Subprocessor Name]". We will work with you to find a resolution. If we cannot accommodate your objection, you may terminate your subscription without penalty.
Contact
Instrumento.io Email: info@instrumento.io Website: instrumento.io/legal/subprocessors