Sub-processors
Every third party that handles personal data for Backlog.cloud, what it does for us, what it sees, where it runs and the safeguard that covers the transfer. This is the named version of section 07 of the privacy policy.
Last updated: 15 October 2026
Each vendor is bound by a written data processing agreement. Where one runs outside the UK and the European Economic Area, the transfer rests on the European Commission Standard Contractual Clauses with the UK International Data Transfer Addendum, or on an adequacy decision where one applies. The training column says whether the vendor may use the data to train or improve a model. For most of them the question does not arise. For the model provider the answer is no, by contract.
When we add a sub-processor, or change what an existing one does with customer data, we update this page and email every workspace owner before the change takes effect. Owners who object can delete their workspace before that date and nothing moves to the new vendor.
One vendor is listed by role rather than by name: the service that carries the meeting bot into calls and produces the live transcript. Its name, data processing agreement and hosting details are available on request to privacy@backlog.cloud.
| Vendor | What it does for us | Data it handles | Region | Transfer safeguard | Model training |
|---|---|---|---|---|---|
| Convex | Application database, backend functions, file storage and scheduled jobs | Account details, workspace content, transcripts, generated artefacts, uploaded images and audio, billing state | EU (Ireland) for the development deployment; production region to confirm | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| VercelData processing agreement | Web hosting for the marketing site and the dashboard | Request logs (IP address, user agent), session cookies in transit | To confirm (global edge network, origin region not pinned in the repository) | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| Meeting bot and live transcription vendorNamed on request to privacy@backlog.cloud | Joins Zoom, Google Meet and Microsoft Teams calls as the Backlog.cloud bot, captures audio and produces the live and final transcript, reads connected calendars for auto-join | Meeting audio and video during the call, participant display names, chat messages addressed to the bot, calendar event titles and join links. Recordings are deleted once the transcript is stored | EU (Frankfurt) | None needed while the data stays in the UK or EEA | To confirm with the vendor |
| Deepgram | Transcribes audio files attached on the Generate page | The audio you attach and the transcript produced from it | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum | To confirm with the vendor |
| AnthropicData processing agreement | Language and vision model that turns transcripts, notes and images into backlog items and the other artefacts | Transcript text, pasted notes, attached images, meeting type and project context sent with each generation | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum | No training on customer content, by contract |
| Google Calendar API | Reads events from a Google Calendar a Team workspace connects for auto-join | Event titles, times, organiser and join links; the connected account email | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| Microsoft GraphData processing agreement | Reads events from an Outlook calendar a Team workspace connects for auto-join | Event titles, times, organiser and join links; the connected account email | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| Google sign-in | Verifies your identity when you choose to sign in with a Google account | Email address, display name and the account identifier Google returns | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| GitHub sign-inData processing agreement | Verifies your identity when you choose to sign in with a GitHub account | Email address, display name and the account identifier GitHub returns | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| StripeData processing agreement | Card payments, subscriptions and invoices | Billing name, email, card details (never seen by Backlog.cloud), subscription and invoice history | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| ResendData processing agreement | Sends the service emails: sign-in links, invitations, billing notices, briefings, privacy request acknowledgements | Recipient email address, name and the content of each email | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
| PostHogData processing agreement | Product analytics, session replay and feature flags | Page views, dashboard events, the signed-in email and name, session recordings with text inputs masked | EU | None needed while the data stays in the UK or EEA | Not applicable: the vendor trains no models on this data |
| SentryData processing agreement | Error monitoring and performance traces for the web app and backend | Stack traces, request metadata, browser details and the account identifier attached to an error | EU (Germany); server-side project region to confirm | None needed while the data stays in the UK or EEA | Not applicable: the vendor trains no models on this data |
| Browser push services (Google, Apple, Mozilla) | Deliver the notifications you opt into during a live meeting | A push subscription token and the notification text, which can include a question the model raised | Global | Standard Contractual Clauses with the UK International Data Transfer Addendum where data leaves the UK or EEA | Not applicable: the vendor trains no models on this data |
The work management platforms you connect (Jira, Azure DevOps, Linear, GitHub, Notion, ClickUp) are not sub-processors. Items are pushed into them on your instruction, into an account you control, so that transfer is yours.
The full privacy policy is at backlog.cloud/privacy. To ask about any row here, or to exercise your rights, use the privacy request form.