Trust & Compliance · Sub-Processors

Trust that is transparent.

All external providers processing personal data on our behalf, with a linked Data Processing Agreement (DPA per Art. 28 GDPR).

As of 1 October 2026Scope: Review & Streaming ClassicPrimarily EU · HQ Germany
★★★★★★★★★★★★
EUPrimarily EU

dfine.io Review

Primarily EU. Edge where it helps.

Our setup: data is processed primarily in the EU, complemented by a performance layer at the edge. All sub-processors store data in the EU or are covered by SCCs or the EU-U.S. Data Privacy Framework.

Vercel

FRA1

App hosting (region fra1). Processes all request and session data.

View DPA ↗

Neon

EU-CENTRAL-1

Postgres database. Primary store for all user, project and media data.

View DPA ↗

Clerk

GLOBAL + DPF

Authentication & identity management. Stores account and profile data.

View DPA ↗

Stripe

EU + DPF

Billing & payments. Processes customer, invoice and payment data.

View DPA ↗

Cloudflare

EU-JURISDICTION

R2 object storage (EU jurisdiction) and Workers. Stores uploaded media files.

View DPA ↗

Amazon Web Services

EU-CENTRAL-1

AWS Batch video and image encoding. Processes media data for transcoding. ISO 27001 · SOC 2 Type II · EU Data Privacy Framework.

View DPA ↗

LiveKit

EU + DPF

Real-time conferencing (audio / video). Processes meeting streams and participant data. SOC 2 Type II.

View DPA ↗

Upstash

EU-CENTRAL-1

Redis rate-limiting and cache. Processes IP, session and counter data.

View DPA ↗

Axiom

EU + DPF

Observability and audit logs (365-day retention). May contain personal log data.

View DPA ↗

Resend

EU-WEST-1

Transactional email delivery. Processes recipient email addresses and content.

View DPA ↗

dfine.io Streaming Classic

Our own servers first.

Focused on private cloud: self-hosted on our own infrastructure at Hetzner in Nuremberg, optionally on Google Cloud in Frankfurt. Database, streaming server and reverse-proxy run on our own infrastructure.

Hetzner

NÜRNBERG

VPS hosting for API, app, database and container registry. Effectively all application data. ISO 27001, data center Nürnberg.

View DPA ↗

Google Cloud

FRANKFURT

Optional private cloud on Google's TISAX-assessed infrastructure (Frankfurt) for compute. ISO 27001, 27017, 27018 · SOC 2 Type II.

View DPA ↗

Stripe

EU + DPF

Billing and payments. Processes customer, subscription and invoice data.

View DPA ↗

Axiom

EU + DPF

Error logging and audit trail. May contain personal log data.

View DPA ↗

ipstack

EU (AUSTRIA)

IP geolocation for geo-blocking. Processes client IP addresses.

View DPA ↗

Resend

EU-WEST-1

Transactional email for account and streaming notifications. Processes recipient email addresses and content.

View DPA ↗

Cloudflare R2

EU-JURISDICTION

Object storage (EU jurisdiction) for profile pictures and branding files.

View DPA ↗

Cloudflare

GLOBAL + DPF

Optional real-time conferencing (audio / video), off by default, turned on per stream. Processes display names, audio, video and connection data.

View DPA ↗

Notes.

  1. Your data runs on a fully ISO 27001 and SOC 2 certified stack. By design we do not operate our own data centers. Instead we build exclusively on independently audited, certified infrastructure partners.
  2. Most DPAs are included by accepting the provider's terms. Countersigned copies are available via the respective vendor dashboard.
  3. Each vendor maintains its own sub-processor list (typically at /legal/sub-processors). Those lists are reviewed during audits.
  4. The majority of data is processed in the EU. A few providers store data in the US (e.g. Clerk for authentication) and are covered via SCCs or the EU-U.S. Data Privacy Framework.
  5. For access, deletion, or data export requests email admin@dfine.io.