Get early access

Sub-processors

Last updated: June 13, 2026

What this page is

A sub-processor is a third-party company we use to help run BrandStudio — hosting, storage, payments, and message delivery. This is the complete, current list, with what each one does and the data it touches. We keep it here so security and procurement teams can review it before they sign.

Current sub-processors

  • Railway — Application hosting, PostgreSQL database, background workers. Data: Core application data — events, guests, accounts, settings. Hosting: United States.
  • Cloudflare — Photo storage (R2), content delivery (CDN), DNS, DDoS protection. Data: Event photos and gallery assets. Hosting: Global edge (US / EU).
  • Vercel — Marketing site and dashboard hosting, edge functions. Data: Page requests and static assets — no guest photos. Hosting: Global edge.
  • Stripe — Payment processing and subscription billing. Data: Billing contact and payment details (card data is handled by Stripe and never stored by us). Hosting: United States.
  • Twilio — SMS delivery of gallery links to guests. Data: Guest phone numbers — only when SMS delivery is turned on. Hosting: United States.
  • Postmark — Transactional email (gallery links, account notifications). Data: Recipient email addresses. Hosting: United States.
  • PostHog — Product analytics inside the dashboard. Data: Usage events (the marketing site runs in cookieless mode). Hosting: United States.

Face recognition runs in-house

Face Match is not handled by a third party. Photos are processed on our own infrastructure, embeddings are encrypted at rest, isolated per company, and deletable at any time. We never send face data to an outside recognition service. See the Trust Center for the full picture.

Changes to this list

When we add or remove a sub-processor, we update this page. If you need advance notice of changes for your own compliance program, tell us when you sign up and we'll add you to the notification list.

Data Processing Agreement

We offer a Data Processing Agreement (DPA) for customers who need one. It incorporates this sub-processor list and our standard GDPR and CCPA terms. Request a copy at security@brandstudiohq.com and we'll send it over.

Questions

Anything about how we handle data? Email security@brandstudiohq.com or read the Trust Center, Security practices, and Privacy policy.