Sub-processors
The third parties that process customer data for SigmaShake services, and what they process.
This list covers vendors that the SigmaShake services use in production today. We list a vendor only when we can show that it is in use.
| Sub-processor | Purpose | Data category | Region |
|---|---|---|---|
| Cloudflare | Hosting and delivery for sigmashake.com and the SigmaShake services (Workers, KV, R2, D1, Analytics Engine, Workers AI, Turnstile bot check) | Request metadata (IP address, user agent), account and session records, product usage events, voice-demo audio sent for transcription, and bot-check tokens | Global edge network by default. Wrangler configuration files do not record an R2 jurisdiction or a D1 or R2 location hint. Cloudflare sets these when a resource is created, so this page does not state that no restriction applies. SigmaShake Fleet binds regional D1 database pools that are labelled US West (WNAM) for DB_US_1 and DB_US_2, and EU West (WEUR) for DB_EU_1 and DB_EU_2, for per-organization data residency. Its DB_DEDICATED_1 pool is unlocated. Cloudflare data-location documentation (fetched 2026-10-11): https://developers.cloudflare.com/r2/reference/data-location/ , https://developers.cloudflare.com/d1/configuration/data-location/ , https://developers.cloudflare.com/kv/reference/data-location/ |
| Stripe | Subscription billing and payment processing | Billing contact, payment details (held by Stripe, not by SigmaShake), subscription status | Not stated by the vendor as a single region. Stripe states that it transfers personal data on a global basis, including to the United States and India, and that its customers transfer personal data to Stripe in the United States. Stripe's sub-processor list (updated 2026-09-27) names Amazon Web Services, with country United States, as a cloud service provider. Sources, fetched 2026-10-11: https://stripe.com/privacy , https://stripe.com/legal/dpa , https://stripe.com/legal/service-providers |
| Resend | Delivery of transactional email (for example account and support messages) | Recipient email address and message content | United States. Resend states that its primary processing operations take place in the United States. Resend does not state a specific cloud region on these pages. Resend's sub-processor list (updated 2026-08-27) shows country United States for each listed sub-processor. Sources, fetched 2026-10-11: https://resend.com/legal/dpa , https://resend.com/legal/subprocessors |
| Google (Google Analytics) | Measurement of visits to sigmashake.com pages | Page views, browser and device metadata, and IP address as sent by the visitor's browser | Not stated in the repository. |
| Cerebras | Language-model inference for AI rule drafting (the default provider for signed-in users of the rule generator) | Prompt text and recent chat messages typed into the rule generator. Known secret patterns are removed before sending. | Not stated in the repository. |
| Anthropic | Language-model inference for AI rule drafting when that provider is selected, and for support-ticket triage and draft replies when that model is selected. Both selections are configuration settings. The default support model runs on Cloudflare Workers AI. | Rule-generator prompt text and chat messages. For support triage: ticket subject and message content. | Not stated in the repository. |
Sign-in providers that you choose (for example Google, GitHub, Discord, or Twitch) receive the sign-in data that you send through them. They are not SigmaShake sub-processors.
Questions and changes
For a data processing agreement or a question about this list, write to our security contact form or security@sigmashake.com.