Subprocessors

Every third party that touches Storm data, what it touches, and where it sits. Storm commits to 30 days’ written notice before adding one — which is why this list has a URL you can diff rather than living in a document you have to request.

SubprocessorRoleData touchedRegion
VercelCompute and hosting for the control plane and this siteCommercial metadata in transit and in function memory; environment configurationFunctions pinned pdx1 (us-west-2)
NeonPostgres — the system of recordAll control-plane data at rest: commercial facts, statements, evidence references and hashes, hashed API credentialsaws-us-west-2, provider-attested via Neon’s API
GitHubSource hosting and CISource code and CI logs. No customer data.US vendor; storage region not contractually pinned
StripeSettlement adapter — only when a deployment configures it, dark otherwiseWhen configured: finalized statement lines delivered as draft invoices in the tenant’s own Stripe accountPer Stripe; not active in the current deployment path
CalendlyScheduling behind the “Book a time” button on the marketing siteWhatever a visitor types to book: name, email address, and anything they write in the booking form. The booking page opens as an overlay, so Calendly’s script and an iframe load into the page — but only after the button is clicked. A visitor who never clicks sends Calendly nothing, and no customer data passes through it in any case.US vendor; storage region not contractually pinned
AnthropicSDK dependency for optional pricing and evaluation featuresNone by default. External model egress is disabled and asserted inside the client, so it cannot be enabled by omission.n/a while disabled

Residency, stated precisely

Postgres compute and storage are provider-attested in aws-us-west-2 — Neon’s own API reports it, rather than it being inferred from a hostname. Function compute is pinned to pdx1. Backup and restore-history placement is declared, not attested: Neon does not publish where restore history physically sits relative to the project region. Log and trace tooling is likewise declared.

That gap is narrower than it was, and it is the written trigger for moving to a Storm-owned single-tenant account.

Change log

Security overview