Subprocessors
Last updated October 15, 2026.
On this page
To run Siamang Studio and Siamang Cloud, Siamang Labs LLC (Siamang) uses the providers below. For our customers’ survey responses, contact lists and project content, Siamang is the customer’s processor, so these providers are subprocessors under our Data Processing Agreement. For account and billing data, Siamang is the controller and the same providers are its processors, as described in the Privacy Policy.
The table describes Siamang Studio. Siamang Cloud uses Google Cloud, Supabase (including sign-in with Microsoft), Resend, Stripe and Cloudflare in the same roles, for the same kinds of data; Vercel serves only Studio.
Current subprocessors
Scroll sideways to see every column.
| Provider | What it does for us | Personal data it receives | Location | When it is used |
|---|---|---|---|---|
| Google Cloud (Google LLC) | Hosts Studio: the server that runs the API, the database, the analyses, the survey pages and stored files; nightly backups; disk snapshots; a copy of the server’s configuration | Everything Studio stores: accounts, organizations, project content, responses and their metadata, contact lists and invitation records, uploaded files, analysis outputs, reports, the Activity trail; the same data inside backups | United States (Northern Virginia, us-east4) | Always |
| Google Cloud (Google LLC), server monitoring | Server logs and metrics | Server logs, which can contain email addresses and IP addresses | Global (Cloud Monitoring and Cloud Logging) | Always |
| Supabase (Supabase, Inc.) | Sign-in: accounts, passwords, sign-in with Google, confirmation and password-reset emails, sessions | Email address, password hash, sign-in provider identity, session tokens, and the IP address and browser of each sign-in | United States (Northern Virginia, us-east-1) | Always |
| Resend (Resend, Inc.) | Email delivery: account and team emails, trial and billing notices; and, from a separate sending domain, the survey invitations and reminders customers send | Recipient address; for invitations also the name and attributes the message uses, the customer’s message and the personal survey link; account emails carry names and organization names | United States (Northern Virginia, us-east-1) | Always |
| Stripe (Stripe, Inc.) | Checkout, subscriptions, year offers, the customer portal, invoices and receipts | From Studio: the organization’s identifier and its short name in Studio, its plan, and Stripe’s customer and subscription identifiers. The buyer enters name, email, card and billing address directly on Stripe’s pages | United States | When an owner buys or manages a plan |
| Vercel (Vercel Inc.) | Serves the Studio web app at studio.siamang.org | IP address, browser, the pages requested, and Studio’s sign-in cookie. Studio’s data goes from the browser straight to our API, not through Vercel | Global edge network; Studio’s server functions in Washington, D.C., USA (iad1) | Always |
| Cloudflare (Cloudflare, Inc.) | DNS for our domains; the Turnstile captcha on Studio’s sign-up and password forms and on surveys whose owner turns the captcha on | For the captcha: the IP address and browser signals of the person solving it; we also send Cloudflare the IP address to verify the check | Global network | Captcha: on those forms and surveys |
| Google Workspace (Google LLC) | Our staff mailboxes, including support@siamang-team.org | Whatever customers, respondents and reporters write to us | Global | Always |
Not in use
We do not currently use any provider for these, and will add one to this list, with the notice described below, before we do:
- running analyses outside our own server (a short-lived cloud machine per analysis);
- the optional AI assistant in Studio, which would send questionnaire and analysis text to a model provider; it is not connected to any provider yet;
- coding respondents’ open answers with the AI assistant, which would send those answers to the model provider. This is switched off on the whole platform.
Services you connect yourself
These are not our subprocessors. They receive data only when someone in your organization sets them up and tells the Services to send data there, and you have your own terms with them:
- Sign-in with Google, and in Siamang Cloud with Microsoft: you deal with the provider directly; we receive your email address, name and account identifier.
- Panel providers such as Prolific, Cint and Dynata: respondents are sent back to the panel’s address with the identifiers you configure.
- Connectors (for example Google Sheets, Excel 365, BigQuery, Amazon S3, Azure, Snowflake, PostgreSQL, Supabase, Airtable, Dropbox, HubSpot, Salesforce, GitHub, GitLab, SFTP, REDCap or your own HTTP endpoint) and outgoing webhooks: what your exports and subscriptions send, using your credentials.
- Repositories such as Zenodo and OSF: the research bundle you deposit, under your own account.
- Media in surveys (YouTube, Vimeo, and the image services and media domains you use) and addresses in your custom CSS or JavaScript: they see each respondent’s IP address and browser when the survey loads them.
How we tell you about changes
We tell customers about a new or replacement subprocessor at least 30 days before it starts processing customer data, by email to the owners of each organization and by updating this page and its date. If a change is urgently needed for security or to keep the Services running, we may make it sooner and tell you as soon as possible.
You can object on reasonable data-protection grounds by writing to support@siamang-team.org within the notice period. The Data Processing Agreement, section 6, describes what happens next.