Porchlight for Communities
Subprocessors
Our Data Processing Addendum promises transparency about who touches your data. Rather than "available on request," here is the current list. We keep it short on purpose, and we update this page before adding a new provider. Last updated July 10, 2026.
| Provider | What it does for Porchlight | What it can touch |
|---|---|---|
| Hetzner (US) | Application hosting | All application data (encrypted volumes) |
| Cloudflare | Edge network, TLS, DDoS protection, DNS | Traffic in transit |
| Amazon Web Services (S3, US) | Media storage | Audio recordings and photos, server-side encrypted |
| Groq | Speech-to-text transcription | Audio of resident stories and family messages, at transcription time |
| Google (Gemini API) | Backup transcription; AI summaries, briefings, and biographies | Audio at transcription time; story transcripts at generation time |
| Resend / Brevo | Transactional email | Recipient name/email and the content of notification emails |
| Twilio | SMS notifications (opt-in only) | Recipient phone number and notification text |
| Stripe | Billing and payments | Community billing contact and payment details (card/bank data never touches our servers) |
The commitments every provider is under
- Each processes data only to provide its service to us — never for advertising, and never to train generalized models on your content without agreement.
- Each is bound by its own data-processing terms with us.
- If a change of provider would materially change how your data is handled, we notify community administrators before it happens.
See also: Security · Data Processing Addendum · HIPAA & BAAs