Last updated: 19 October 2026
These companies run the infrastructure behind the Service and process personal data for us.
| Subprocessor | What it does for us | Data | Location |
|---|---|---|---|
| Render | Hosting for the API and the database | all stored data | US and EU |
| Inngest | Runs background jobs and schedules | job inputs and results in transit | US and EU |
| Cloudflare (R2) | File storage: uploads, generated media, exports | files | US and EU |
| Clerk | Sign-in, sessions and sign-in codes | name, email, sign-in records | US and EU |
| Resend | Pramaan's own email: invites, receipts, notices | email addresses, message content | US and EU |
| Dodo Payments | Sells credit as merchant of record; tax and receipts | billing name, email, payment | US and EU |
| Mintlify | Hosts the docs site | visitor logs | US and EU |
Providers that carry out superpowers
Each superpower is carried out by one or more third-party providers. Which one depends on the call and changes over time. They receive only what that call needs and a hashed workspace tag. By category, they are:
- people and company data providers;
- telephony and messaging providers (phone numbers, SMS, voice);
- email inbox and sending providers;
- connected-app platforms (for apps you connect, such as a CRM or calendar);
- social posting providers;
- AI model providers;
- web search, scraping and other public-data providers.
Customers who sign the DPA receive the full named list.
Changes
We will give 30 days' notice of a new subprocessor to builders who have signed the DPA. They can object.