Subprocessors
Last updated:
Shower uses the third-party companies listed in the table below (“Subprocessors”) to help deliver our service. Each Subprocessor is contractually bound to data protection obligations consistent with our Data Processing Agreement.
For details about how we secure customer data, see our Security page. This page is the single source of truth for the subprocessor list — our Privacy Policy and DPA reference it directly rather than maintaining a separate copy. The canonical machine-readable URL is https://shower.dev/subprocessors.
| Subprocessor | Purpose | Region | Privacy Policy |
|---|---|---|---|
| Vercel | Application hosting and edge network | United States / Global edge | View |
| Supabase | Authentication and PostgreSQL database | EU (eu-west-1, Ireland); United States (us-east-1) for the app database of projects in the United States region | View |
| Cloudflare | CDN, DNS, and R2 object storage | Global edge (R2 project storage restricted to the European Union; to the United States for projects in the United States region). Copies of project files and backups made before we switched storage on 27 September 2026 remain in our previous storage, which Cloudflare places in Western Europe (or eastern North America for projects in the United States region) on a best-effort basis without a jurisdiction restriction, until they are deleted. | View |
| Anthropic | AI models (Claude API): generating code from the project's code and from what the customer writes, attaches or asks Shower to read, and answering visitors in the AI assistant a customer can add to their published app | United States | View |
| Google LLC | Gemini AI inference and analytics measurement where enabled | United States / Global | View |
| OpenAI | AI review, fallback inference, and Codex-assisted workflows | United States | View |
| Stripe | Payment processing and subscription billing | EU / Global | View |
| Sentry | Error monitoring and crash reporting | EU | View |
| PostHog | Product analytics and session replay | EU | View |
| RudderStack | Event pipeline and marketing attribution routing | United States | View |
| Modal | Sandboxed code execution containers | Not region-pinned — builds observed in the EU and the United States | View |
| Customer.io | Lifecycle and transactional email | EU (Belgium data center) | View |
| Resend | Transactional email delivery and customer-authorized email connector | United States (sending region may vary by domain) | View |
| Upstash | Redis cache, rate limiting, semantic cache of prompts and AI responses, and customer memory recall | EU (Redis and Vector: AWS eu-west-1, Ireland) | View |
| Axiom | Application logging and observability | United States | View |
| Temporal Cloud | Workflow orchestration for sandbox lifecycle | EU (eu-central-1) | View |
| Braintrust | LLM observability for chat generations | Not verified — our account region has not been read | View |
| Google Cloud Run | Sandbox orchestration — runs customer-generated code and environment variables | EU (europe-west4 per service URL — service config not yet verified) | View |
| PhotoRoom | Image background removal and compositing | Global — not region-pinned | View |
| Pexels | Stock photo search and preview thumbnails | Global — not region-pinned (vendor policy names the United States, European Union, United Kingdom, Australia, Singapore, Philippines and New Zealand) | View |
| GitHub | Automated jobs (GitHub Actions), including: nightly backup copy, backup restore checks, backup erasure, backup configuration checks, read-only log and analytics queries, and automated incident response that receives error reports forwarded from our monitoring; job results kept as workflow artifacts | Virtual machines in Microsoft Azure; GitHub does not state the region | View |
Planned subprocessors
We intend to add the companies below. They do not process our customers' personal data yet. Each one may start no earlier than its earliest start date, which is at least 30 full days after the day it was announced here. Customers can object as described in section 4 of our Data Processing Agreement.
Mailgun (Sinch)
- Purpose
- Transactional email: invitations to customers' app users and account emails
- Region
- EU — intended; not yet verified. Moves into the table above once live and measured
- Announced
- Earliest start
International Transfers
Where a Subprocessor is located outside the European Economic Area, transfers are protected by the European Commission's Standard Contractual Clauses and supplementary measures where applicable. Personal data sent to AI providers (Anthropic, Google, OpenAI) is transmitted via API integrations under agreements that prohibit training on customer data.
Updates
We update this list whenever we add or remove a Subprocessor. We announce each new Subprocessor on this page at least 30 full days before it starts processing our customers' personal data. If you would also like each announcement by email, write to legal@smoothly.dev and we will send it to you.
Questions
For questions about our Subprocessors or data processing arrangements, contact legal@smoothly.dev.