Sub-Processors
Last updated: October 9, 2026
1. About this list
ScoutSocial engages the following sub-processors to provide the platform. We will update this list and notify customers before engaging new sub-processors, as described in our Data Processing Agreement.
2. Current Sub-Processors
| Provider | Purpose | Data categories | Location | Transfer mechanism | DPA in place |
|---|---|---|---|---|---|
| Clerk | Authentication and identity management | Account identifiers, email, session metadata | United States | EU SCCs Module Two + UK IDTA | Yes |
| Paddle.com Market Limited (Paddle) | Merchant of record for ScoutSocial subscriptions: checkout, payment processing, tax, invoicing, refund execution, subscription management | Billing identifiers, invoice references, payment-card data (handled by Paddle, not stored by ScoutSocial) | United Kingdom | EU SCCs + UK adequacy | Yes |
| Amazon Web Services (AWS) | Cloud infrastructure, hosting, data storage (S3), content delivery (CloudFront), and transactional email (SES) | All hosted Customer data | United States / EU (Frankfurt) | EU SCCs Module Two + UK IDTA | Yes |
| OpenAI | LLM inference for content generation, image generation, and pre-publish moderation when enabled | Prompts, generated outputs (identifiers redacted before transmission) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| OpenAI (Whisper) | Speech-to-text transcription of uploaded video audio | Uploaded video audio (transient; deleted after transcription) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| OpenAI (Text-to-Speech) | Synthetic voice-over for AI video: reading the narration of each scene aloud | Scene narration text (transient). No voice recording of any person is sent, and no voice is cloned — the speaker is one of the provider's synthetic preset voices | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| Google LLC (Veo, Gemini API) | Image-to-video generation for AI video: turning one scene's still image into a short video clip when the author asks for it (“Animate this scene”; not yet enabled for customers) | The scene's still image (an AI-generated image or an image from the Customer's own library) and the scene's written description. No prompts about people, no member data, no Connected Platform data | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause (paid API tier) | Yes |
| Anthropic | LLM inference for content generation (alternative provider) | Prompts, generated outputs (identifiers redacted before transmission) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| TypeSafe AI, Inc. (Jev) | Classifying a content request into a post objective (for example educate, announce or promote) when the author has not chosen one, so the AI pipeline can pick the right format | The author's own request text, up to 2,000 characters, with identifiers (email addresses, phone numbers, handles, profile URLs) redacted before transmission. No Connected Platform data and no fetched article content | United States | EU SCCs Module Two + UK Addendum + no-training clause | Yes |
| LangChain, Inc. (LangSmith) | LLM tracing and observability when enabled. Traces may include redacted prompts and tool outputs; Connected Platform member PII is stripped by our redactor before export. Retention: 14 days (LangSmith's base trace tier). | Redacted prompts, tool traces, operational telemetry | United States | EU SCCs Module Two + UK IDTA | Yes |
| Tavily | Web search and retrieval for the agentic AI content pipeline (grounding/research queries) | Non-personal search terms/topics derived from prompts — no user Personal Data is sent | United States | N/A — no Personal Data transferred | N/A — no Personal Data |
| Google Analytics | Website and product analytics (with user consent) | Pseudonymous usage events, device metadata | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Meta Platforms (Meta Pixel) | Website advertising and conversion analytics (with user consent) | Pseudonymous usage events, device metadata, browser identifiers (_fbp) | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Google (reCAPTCHA) | Bot and abuse protection on public forms (beta signup, contact) | IP address, device/browser signals | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Google LLC / YouTube API Services | Video publishing, channel management, and performance analytics when Customers connect YouTube accounts | YouTube channel/video metadata, analytics, OAuth tokens | United States / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| LinkedIn Corporation (Microsoft) | OAuth and LinkedIn Marketing + Community Management APIs for publishing, analytics, and listening when Customers connect LinkedIn accounts | LinkedIn profile, post, analytics and Member data (subject to LinkedIn caps) | United States / EU / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| X Corp. | OAuth and X API (v2 + Account Activity) for publishing, analytics, and listening when Customers connect X accounts | X profile, post, analytics, and interaction data | United States / Global | EU SCCs Module One (C2C) + EU-US DPF certification (incl. Swiss-US, UK Extension) | Yes |
| Meta Platforms, Inc. | Facebook Login and Graph API / Instagram Graph API for publishing and analytics when Customers connect Facebook Pages or Instagram Business accounts | Page/account metadata, post content, insights, comment metadata, OAuth tokens | United States / Ireland / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| TikTok Inc. | OAuth and TikTok for Developers APIs (Content Posting, Display) for publishing and analytics when Customers connect TikTok accounts | TikTok open_id, profile, video metadata, analytics, comment metadata | United States / Singapore / Global | EU SCCs Module One (C2C); EU/UK controller is TikTok Technology Limited (Ireland) | Yes |
| Vercel, Inc. | Frontend hosting and edge delivery | Static assets, request metadata | Global (edge network) | EU SCCs Module Two + UK IDTA | Yes |
| Redis Labs (Redis Inc.) | In-memory caching and task queue | Cached session data, queued job metadata | United States | EU SCCs Module Two + UK IDTA | Yes |
| Linear Orbit, Inc. (Linear) | Issue tracking for in-product bug reports and feature requests submitted by workspace users | Feedback text, submitting user identifier, workspace metadata | United States | EU SCCs Module Two + UK IDTA | Yes |
| Functional Software, Inc. (Sentry) | Error and crash reporting for platform reliability | Error data, stack traces, operational metadata; user identifiers stripped/pseudonymised before transmission | United States | EU SCCs Module Two + UK IDTA | Yes |
| Airtable, Inc. | Beta programme only. Database of beta sign-ups and participant information | Sign-up and profile information | United States | EU SCCs Module Two + UK IDTA | Yes |
| MailerLite (UAB MailerLite) | Beta programme only. Sending operational beta emails (onboarding, programme updates). No promotional email is sent | Name, email, programme status | EU (Ireland) | Within the EEA — no transfer mechanism required | Yes |
| Zapier, Inc. | Beta programme only. Moving sign-up data between Airtable and MailerLite | Name, email, programme status | United States | EU SCCs Module Two + UK IDTA | Yes |
| Linear Orbit, Inc. (Linear) | Issue tracking for in-app product feedback and bug reports submitted via the Send feedback form | Feedback message text, attached screenshots, submitting user and organisation identifiers, page and browser context | United States | EU SCCs Module Two + UK IDTA | Yes |
ScoutSocial does not store full payment-card details; card data is handled by Paddle.
3. Contact
Email: legal@scoutsocial.ai