Subprocessors
Every third party that touches Storm data, what it touches, and where it sits. Storm commits to 30 days’ written notice before adding one — which is why this list has a URL you can diff rather than living in a document you have to request.
| Subprocessor | Role | Data touched | Region |
|---|---|---|---|
| Vercel | Compute and hosting for the control plane and this site | Commercial metadata in transit and in function memory; environment configuration | Functions pinned pdx1 (us-west-2) |
| Neon | Postgres — the system of record | All control-plane data at rest: commercial facts, statements, evidence references and hashes, hashed API credentials | aws-us-west-2, provider-attested via Neon’s API |
| GitHub | Source hosting and CI | Source code and CI logs. No customer data. | US vendor; storage region not contractually pinned |
| Stripe | Settlement adapter — only when a deployment configures it, dark otherwise | When configured: finalized statement lines delivered as draft invoices in the tenant’s own Stripe account | Per Stripe; not active in the current deployment path |
| Calendly | Scheduling behind the “Book a time” button on the marketing site | Whatever a visitor types to book: name, email address, and anything they write in the booking form. The booking page opens as an overlay, so Calendly’s script and an iframe load into the page — but only after the button is clicked. A visitor who never clicks sends Calendly nothing, and no customer data passes through it in any case. | US vendor; storage region not contractually pinned |
| Anthropic | SDK dependency for optional pricing and evaluation features | None by default. External model egress is disabled and asserted inside the client, so it cannot be enabled by omission. | n/a while disabled |
Residency, stated precisely
Postgres compute and storage are provider-attested in aws-us-west-2 — Neon’s own API reports it, rather than it being inferred from a hostname. Function compute is pinned to pdx1. Backup and restore-history placement is declared, not attested: Neon does not publish where restore history physically sits relative to the project region. Log and trace tooling is likewise declared.
That gap is narrower than it was, and it is the written trigger for moving to a Storm-owned single-tenant account.
Change log
- 2026-08-23 — Calendly added. The site’s call to action became a booking link, so a visitor who clicks it now hands their name and email to a third party. Listed on the same day it shipped rather than at the next review — the 30-day notice commitment is about adding a subprocessor that touches customer data, and this one does not, but a list that omits a vendor because it fell outside the strict definition is not a list anyone can trust. Later the same day the link became an in-page overlay, which loads Calendly’s script and an iframe — on click only, never on page load.
- 2026-08-06 — List first published as a page. No subprocessor added or removed.