Subprocessors

1.What this list is

When your business puts personal information into Scale Suite, like your clients' names and emails, we handle it for you as your service provider. These companies help us do that. Each one works under a contract with us, only for the job listed, and is not allowed to sell your information or use it to train AI models. The Data processing addendum explains how we choose and oversee them.

2.Service providers that handle your business content

• Cloudflare, Inc.: Hosts Scale Suite and its server code, stores account and app data (including Chat messages, files in Drive and documents in Sign, encrypted at rest), and runs Workers AI for images AI makes. When it is switched on, its TURN service relays Video call media for people on networks that block direct connections; the media stays encrypted between the browsers, and Cloudflare cannot see or hear it. Data involved: account details, business content you save, image prompts, relayed call media (encrypted), and request logs such as IP addresses. Where: United States, and the Cloudflare data center nearest each request.
• Supabase, Inc.: Real time connections for Video calls (the signaling that sets up the call between browsers, and the list of who is in a call) and for live booking pages. Data involved: call room names, the display names shown in a call's presence list, signaling messages, and booking requests while they are in flight. Call audio and video go directly between browsers and do not pass through Supabase. Where: United States (project region to be confirmed).
• Anthropic, PBC: The Claude AI models behind AI, for writing and answers, AI notes in Video (only when everyone in the call agrees) and Catch up in Chat. Data involved: the content AI needs for the task you asked for, such as a call transcript or the Chat messages you are allowed to see, including any memory notes it uses. Where: United States.
• Stripe, Inc.: Scale Suite Pay payment processing, business verification and payouts, and billing for Scale Suite plans. Data involved: payment details, business and owner details Stripe needs to verify your business, and payment records. Where: United States.
• Plaid Inc.: Read only bank connections in Money. Data involved: bank account names, balances and transactions from banks you choose to connect. Where: United States.
• Tucows Inc. and Tucows Domains Inc. (OpenSRS): [Planned registrar and email partner.] Domain registration, and hosting of Scale Suite Mail mailboxes. Data involved: domain contact details, and the email stored in your mailboxes. Where: Canada for mailboxes; domain records go to the registry for each domain.
• Apple Inc.: Apple Wallet passes your business issues, and the push notices that update them. Data involved: pass contents and the device identifiers Apple sends when a pass is added. Where: United States.
• Resend, Inc.: Delivers sign in and account emails for Scale ID ("Continue with Scale"). Data involved: email addresses and the sign in email itself. Where: United States.

3.Services you choose to use

• Google and Microsoft: only if you choose "Continue with Google" or "Continue with Microsoft" to sign in. They confirm who you are and send us your name and email.
• Browser speech services from Google and Microsoft: live captions in Video use the speech recognition built into your browser, which may send your audio to its maker's speech service, such as Google for Chrome and Microsoft for Edge. Each person decides whether to turn captions on, and that service handles the audio under its own terms.

4.Services that do not receive your business content

These help pages load or check things, and see only what any website sees, like your IP address, or no personal information at all:

• Google Fonts, jsDelivr and cdnjs (Cloudflare) deliver fonts and open source code to your browser.
• Google Cloud Storage delivers the background blur model for Video to your browser.
• Domain registries and the Cloudflare and Google DNS services answer domain availability checks. Only the domain name is sent.
• Have I Been Pwned checks new passwords against known leaks. Only the first five characters of a scrambled version of the password are sent, never the password.

5.Changes to this list

We tell you at least 30 days before we add a new service provider that will handle your business content, by email and in the app, and we update this page. If you object, tell us at legal@scalembs.com, and the Data processing addendum explains what happens next.

Email and text delivery providers for messages your business sends from Scale are not chosen yet. We will add them here before those features go live.