Cloudflare, Inc.
CDN, edge compute, DNS, Turnstile, Web Analytics, R2 storage, lead-magnet page hosting. Visit metadata, IP (truncated for analytics), form submissions, customer voice samples.
A current list of every sub-processor, every certification, and every change since the last revision.
What follows is the working truth — updated when it changes, never when it is convenient. If a vendor appears anywhere on cmintel.ai that is not in this list, that is a bug; mail [email protected].
Customers: our own Data Processing Addendum, including the fleet-learning rules, is at /dpa.
Sub-processors
Supabase Inc.
Primary operator database (PostgreSQL 16). Account data, user-generated content.
SendGrid (Twilio Inc.)
Transactional email, contact-form delivery, DSAR verification emails, and email to, and contact lists of, a customer's own audience (lead-magnet delivery). Email address, message content.
Stripe Payments UK Ltd
Payment processing, on activation of subscription billing (Phase 7). Email, payment card token (Stripe-vaulted).
Anthropic, PBC
Language-model inference. Content drafts, scripts, prompts and niche/brand strategy text.
OpenAI, LLC
Text embeddings and language-model inference. Content drafts, scripts and strategy text.
Sentry (Functional Software, Inc.)
Error monitoring. Error stack traces, anonymised user identifiers — PII scrubbed before transmission.
Zernio
Publishing to connected social platforms; holds the platform connections (OAuth grants) for each customer channel. Customer content (video, image, caption), channel identifiers, post analytics.
Temporal Technologies Inc. (Temporal Cloud)
Workflow orchestration. Workflow inputs and results pass through it, including content drafts, scripts and customer/stream identifiers.
ElevenLabs Inc.
Text-to-speech voiceover from content scripts; voice cloning where a customer supplies a voice sample. Scripts, voice samples.
Kling AI (Kuaishou Technology)
Text-to-video generation from content prompts. Content prompts and generated video.
Black Forest Labs (Flux)
Image generation from content prompts. Content prompts and generated images.
Perplexity AI, Inc.
Trend research for a customer's niche. Niche and topic queries.
D-ID
Lip-sync talking-head video. Image and audio of the presenter; personal data if a real person's face or voice is used.
AssemblyAI, Inc.
Transcription of source videos, which can include customer-supplied media. Audio.
Deepgram, Inc.
Fallback transcription of source videos. Audio.
Brave Software, Inc. (Brave Search API)
Primary trend and news research for a customer's niche. Short search keywords derived from the niche. No personal data.
NewsAPI (newsapi.org)
News research for a customer's niche. Short search keywords. No personal data.
Google (Google Trends)
Search-demand comparison for a customer's niche. Short search keywords. No personal data.
Pexels
Stock b-roll video search. Short keywords derived from a customer's script. No personal data.
Pixabay
Fallback stock b-roll video search. Short keywords derived from a customer's script. No personal data.
We are completing a signed DPA with every vendor on this list; each row shows its DPA status. When you connect a social or advertising account and tell us to publish or advertise on it, we send your content and use your account authorisation with that platform (YouTube/Google, Instagram and Facebook/Meta, TikTok, Pinterest, X, Google Ads). Those platforms act under their own terms with you. They are recipients at your direction, not our sub-processors.
Certifications
SOC 2 Type II — not yet started. We intend to begin a SOC 2 readiness assessment once we have paying customers, and will name the audit firm and window here when the engagement is signed.
ISO 27001 — under evaluation; we will commit publicly when the engagement begins.
UK GDPR Article 30 record of processing activities — maintained internally; available to data subjects and supervisory authorities on request via [email protected].
Change log
- 2026-10-20
Corrections. We reviewed every claim on /trust, /security and /privacy against what is actually in place. Added 14 sub-processors that were processing data but were missing from this list: Zernio, Temporal Cloud, ElevenLabs, Kling AI, Black Forest Labs, D-ID, Perplexity, AssemblyAI, Deepgram, Brave Search, NewsAPI, Google Trends, Pexels and Pixabay. Corrected the Anthropic and OpenAI purposes (content is not anonymised before it is sent), and added voice samples and lead-magnet pages to Cloudflare and audience email to SendGrid. Corrected the 2026-04-30 entry, which said all seven sub-processors were under signed DPA; that was not accurate at the time. Reworded our statements on SOC 2, third-party penetration testing, dependency and code scanning, international transfer safeguards and audit-log review as dated plans. Confirmed MFA on every human account that can reach customer data and our quarterly internal penetration test. Each row now shows its DPA status. Named the social and advertising platforms that receive content at a customer's direction.
- 2026-10-18
Customer Data Processing Addendum published at /dpa. Section 9 covers fleet learning: COLOSSEUM's central brain learns from every customer's content and results, post by post, as a condition of service. Terms section 7A and privacy section 4.2 added to match.
- 2026-05-04
Sub-processor list published. Initial set: 7 vendors. Stripe entry pending payment activation.
- 2026-04-30
Sub-processor list prepared. Initial set: 7 vendors. (Corrected 2026-10-20: this entry originally said all seven were under signed DPA. That was not accurate. See the 2026-10-20 entry above.)
Subscribe to changes: mail [email protected].
Last updated 2026-10-20