Trust Center / Subprocessors
Register version 2026.2 · effective 2026-06-21
Change notification: existing customers receive at least 30 days' advance notice by email before any new subprocessor begins processing their data, and may object in writing within 30 days (see the objection process below).
Arcamatrix uses the following third-party processors to deliver the service. Each is bound by a Data Processing Agreement (DPA) and may process user data only for the purposes listed. The EU transfer column states the mechanism for any processing outside the EU/EEA — EU Standard Contractual Clauses (SCC), an additional Transfer Impact Assessment (TIA) for higher-risk jurisdictions, or processing kept within the EU/EEA. For enterprise DPAs incorporating this register by reference, contact legal@arcamatrix.com.
| Processor | Purpose | Data categories | Region | EU transfer | DPF |
|---|---|---|---|---|---|
| Anthropic | LLM inference (Claude models) | Prompts + completions | US | SCC | to confirm |
| OpenAI | LLM inference (GPT models) | Prompts + completions | US (contracted via OpenAI Ireland Ltd) | SCC | to confirm |
| Higgsfield | AI video generation. Routes to the onward model engines listed below. | Video briefs (text), source/presenter images, generated assets | US (provider) — onward engines vary, see below | SCC + TIA | to confirm |
| fal.ai | Image generation (FLUX) — the default image-generation vendor | Image prompts (text) + generated images | US | SCC | to confirm |
| ElevenLabsoptional — only when enabled | Text-to-speech voiceover (optional — only when enabled) | Script text + generated audio | US | SCC | to confirm |
| Hetzner Online GmbH — compute | Application hosting (compute, network) | All user data in transit + at rest on application servers | EU (Germany — Falkenstein/Nuremberg; Finland — Helsinki) | EU/EEA (no transfer) | — |
| Hetzner Object Storage | Object storage for rendered videos, images + audio assets | Generated media assets (may incidentally contain personal data) | EU (Germany/Finland — fsn1 / nbg1 / hel1) | EU/EEA (no transfer) | — |
| Cloudflare | DNS, TLS termination, DDoS mitigation | Request metadata + IP | Global edge | SCC | to confirm |
| Upstash | Redis (session cache, queues, API-key + run metadata) | Session ids, API-key hashes, webhook configs, run state | EU/US (region-configurable) | SCC | to confirm |
| Stripe | Payment processing + subscription billing | Billing email, card last-4, invoice data | Global (US) | SCC | to confirm |
| Brevo (Sendinblue) | Transactional email (magic links, receipts, notifications) | Email address + message content | EU (France) | EU/EEA (no transfer) | — |
| PostHog | Product analytics (opt-in via cookie consent) | Anonymous usage events + session metadata (consent-gated) | US (us.i.posthog.com) | SCC | to confirm |
| Sentry (Functional Software, Inc.) | Error monitoring + performance traces (opt-in via cookie consent) | Stack traces, request metadata (PII scrubbed) | US | SCC | to confirm |
| TikTok | Video publishing (user-authorized OAuth) | Video files + captions — only with user OAuth | Global | User-authorized | — |
| YouTube (Google) | Video publishing (user-authorized OAuth) | Video files + metadata — only with user OAuth | Global | User-authorized | — |
| Instagram (Meta) | Video publishing (user-authorized OAuth) | Video files + captions — only with user OAuth | Global | User-authorized | — |
| X (Twitter) | Video publishing (user-authorized OAuth) | Video files + captions — only with user OAuth | Global | User-authorized | — |
Our video-generation provider (Higgsfield) forwards each render to one of several model engines whose jurisdictions differ from the provider's. We disclose them in full so the complete transfer chain is visible. Notably, Kling is operated by Kuaishou with servers in Singapore — it is not a US transfer — and relies on SCCs plus a Transfer Impact Assessment.
| Onward engine | Via | Region | EU transfer |
|---|---|---|---|
| Kling (Kuaishou Technology) | Higgsfield | Singapore (servers; operator Beijing-based, processing may occur in China) | SCC + TIA |
| Seedance (ByteDance) | Higgsfield | Operator ByteDance; processing region to confirm | SCC + TIA |
| Veo (Google) | Higgsfield | US (Google) | SCC |
| Wan (Alibaba) | Higgsfield | Operator Alibaba; processing region to confirm | SCC + TIA |
Full mechanism detail per engine is in the EU-transfers annex.
Get an email when this register changes. We use this only to send subprocessor-change notices.
v2026.2 · 2026-06-21
Accuracy revision. Corrected the transfer posture for video generation: Kling (via Higgsfield) is operated by Kuaishou with servers in Singapore (no EU adequacy decision) — added as an onward subprocessor under SCC + a Transfer Impact Assessment, replacing the prior incorrect 'US' label. Disclosed Higgsfield's onward models (Kling/Seedance/Veo/Wan). Corrected transactional email from Resend (US) to Brevo (EU), the processor actually in use. Added Hetzner Object Storage (EU) and PostHog product analytics (US, opt-in). Marked fal.ai as ACTIVE (the default image vendor), not phased out. DPF self-certifications shown as 'to confirm' where they could not be verified against the official register.
v2026.1 · 2026-05-25
Initial published subprocessor register (DPA Art. 28 attachment).
See also Trust Center · DPA · EU-transfers annex · Privacy Policy · support@arcamatrix.com