Sub-processors
The companies that process customer data for Sarga, what each one does, and where. This list matches Exhibit C to our Data Processing Addendum.
Exhibit C version 5, last updated 2026-09-11
Active sub-processors
| Sub-processor | What it does | Where | Customer data it receives |
|---|---|---|---|
| Railway Corp. | Application hosting and the primary database. | US East (Virginia) | Account, content, audit and governance records. |
| Vercel Inc. | Web app hosting and content delivery. | Global edge, primary build region US East | Browser session data. Customer content goes from your browser to the API, not through Vercel. |
| Resend, Inc. | Transactional email: password resets, invites, digests and sub-processor notices. SendGrid (Twilio) is a configured fallback. | US | Email addresses and message content such as campaign titles, verdict summaries and names. |
| Cloudflare Inc. | DNS only. | Global | Hostnames only. No personal data. |
| WorkOS Inc. | Single sign-on, only if you turn it on. | US | Sign-in assertions: email, name, group claims and identity-provider IDs. |
| Amazon Web Services (S3) | Storage for generated creative assets, only when configured. | us-east-1 unless configured otherwise | Generated image and video files and their names. No account data. |
| Fireworks AI, Inc. | The Sarga Reviewer shadow lane: an open-weight model gets the same review prompt as your chosen model, on Sarga's credentials, to measure agreement. You never see its output. Off for any customer with a training-data carve-out. | US | Content submitted for review and your ratified rules as context. No account data. |
Used only when you turn on a feature
| Service | What it does | When |
|---|---|---|
| Anthropic | Embeddings through your Anthropic key when no OpenAI key is set. | A fallback you can enable. |
| Google PageSpeed Insights | Page speed scoring for the brand visibility panel. | When enabled. |
| Wikipedia / MediaWiki API | Checks whether your company has a public footprint. | Brand visibility checks. Sends only your company name or domain. |
| Google News public RSS | Counts news mentions of your company. | Brand visibility checks. Sends only your company name or domain. |
| ElevenLabs | Synthetic voice generation. Cloned or professional voices need a signed voice-rights record. | Each time you request it. Receives the script and any reference voice sample. |
| Runway | Image-to-video generation. Every request needs a likeness attestation. | Each time you request it. Receives reference images and prompts. |
| AI providers you choose | Generation and review on your own keys: Anthropic, OpenAI, Google, Stability, Azure OpenAI, Bedrock or Vertex. | They work for you under your keys, so they are not Sarga's sub-processors. |
Changes to this list
We give notice of a new sub-processor to your designated data protection contact and on this page, before it starts processing your data. Your Data Processing Addendum sets the notice period and how to object.
No sub-processor has been retired yet.