Porchlight for Communities
Subprocessors
Our Data Processing Addendum promises transparency about who touches your data. Rather than "available on request," here is the current list. We keep it short on purpose, and we update this page before adding a new provider. Last updated September 26, 2026.
| Provider | What it does for Porchlight | What it can touch |
|---|---|---|
| Hetzner (US) | Application hosting | All application data (encrypted volumes) |
| Cloudflare | Edge network, TLS, DDoS protection, DNS | Traffic in transit |
| Amazon Web Services (S3, US) | Media storage | Audio recordings and photos, server-side encrypted |
| Groq | Speech-to-text transcription | Audio of resident stories and family messages, at transcription time |
| Google (Gemini API) | Backup transcription; AI summaries, briefings, and biographies | Audio at transcription time; story transcripts at generation time |
| Resend / Brevo | Transactional email | Recipient name/email and the content of notification emails |
| Twilio | SMS notifications (opt-in only) | Recipient phone number and notification text |
| Stripe | Billing and payments | Community billing contact and payment details (card/bank data never touches our servers) |
Where each provider's terms stand today
We would rather tell you exactly where we are than make a promise we can't yet keep.
- Hosting, storage, delivery and billing (Hetzner, Cloudflare, Amazon Web Services, Resend, Brevo, Twilio, Stripe) are used under each provider's standard business terms; each offers data-processing terms for customer data, and we are confirming that each one is executed on our account.
- Transcription and AI (Groq and Google Gemini) are currently accessed on developer/free-tier terms. Those terms can allow the provider to retain and use submitted content, including to improve their models, which is not good enough for residents' stories. We are moving both to paid service terms with a data-processing agreement that excludes training on your content, and we will have those terms in place before any resident's audio is processed in a live community pilot. We will update this page when that is done.
- None of these providers is permitted by us to use your content for advertising, and we never sell resident or family data.
- If a change of provider would materially change how your data is handled, we notify community administrators before it happens.
Questions about any provider: patrick@porchlight.ing.
See also: Security · Data Processing Addendum · HIPAA & BAAs