Sub-processors
The service providers We Do Dev Work uses to run Signal, and what each one handles. We announce changes 30 days in advance (Data Processing Agreement §5).
| Provider | What for | Personal data it handles | Location | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting: application servers, landing page, logs, secrets | All Service data passing through the application | EU (Frankfurt, eu-central-1) | Within the EU |
| Supabase, Inc. | Database hosting and backups (project in AWS Frankfurt) | All Service data | EU (Frankfurt, eu-central-1) | Stored in the EU; EU standard contractual clauses in Supabase's data processing agreement |
| TypeSafe AI, Inc. | The judgment model (Jev) that estimates readiness | Pages viewed, events, answers to non-identity questions, company name, "facts" (traits). Never the name, email, phone or IP address Signal collects. | United States | EU standard contractual clauses |
| Mistral AI SAS | Wording of questions and offers; setup suggestions; matching visitors' words to the Customer's options | For wording: no visitor data (placeholders are filled in by Signal afterwards). For matching: a typed "Something else…" answer, or a chat message if the Customer turns on the quick answer pick, with emails, phone numbers and known names masked. During setup: summaries of the Customer's public web pages, with emails and phone numbers masked (these can mention people named on the website). | EU (France) | Within the EU |
| Resend, Inc. | Signal's own emails to account holders | Account name and email, invitation details (inviter and project name), usage numbers | United States | EU standard contractual clauses in Resend's data processing agreement |
| Stripe Payments Europe, Ltd. | Payments and invoices | Account email, billing details | Ireland / United States | EU standard contractual clauses in Stripe's data processing agreement |
Not sub-processors (the Customer chooses and contracts them):
- the Customer's own email provider (for example the Customer's Resend account)
- the location and network databases (DB-IP Lite), which run on Signal's own servers; no data is sent to anyone
- booking tools (for example Calendly)
- the Customer's own Google Workspace (Google Calendar), when the Customer connects team calendars: Signal reads only when each connected person is busy, and creates the meeting a Visitor books in that person's calendar, with the Visitor's name and email, the topic they chose and what Signal read from the visit; Google sends the invitation and adds a Meet link
- webhook targets
Last updated: 1 November 2026