Porchlight for Communities
Subprocessors
Our Data Processing Addendum promises transparency about who touches your data. Rather than "available on request," here is the current list. We keep it short on purpose, and we update this page before adding a new provider. Last updated October 6, 2026.
| Provider | What it does for Porchlight | What it can touch |
|---|---|---|
| Hetzner (US) | Application hosting | All application data (encrypted volumes) |
| Cloudflare | Edge network, TLS, DDoS protection, DNS | Traffic in transit |
| Amazon Web Services (S3, US) | Media storage | Audio recordings and photos, server-side encrypted |
| Groq (US) | Speech-to-text transcription; AI tidying, summaries, briefings and biographies | Audio of resident stories and family messages at transcription time; story transcripts at generation time. Not stored afterwards (see below) |
| Resend / Brevo | Transactional email | Recipient name/email and the content of notification emails |
| Twilio | SMS notifications (opt-in only) | Recipient phone number and notification text |
| Stripe | Billing and payments | Community billing contact and payment details (card/bank data never touches our servers) |
Where each provider's terms stand today
We would rather tell you exactly where we are than make a promise we can't yet keep.
- Hosting, storage, delivery and billing (Hetzner, Cloudflare, Amazon Web Services, Resend, Brevo, Twilio, Stripe) are used under each provider's standard business terms; each offers data-processing terms for customer data, and we are confirming that each one is executed on our account.
- Transcription and AI run on one provider, Groq, under Groq's customer Data Processing Addendum. Groq processes our content only to provide the service to us and does not use it to train models. We have turned on Groq's zero data retention setting for our account, so audio and text sent for transcription and AI drafting are not kept by Groq after the request is answered. As of October 6, 2026, resident content is no longer sent to Google.
- None of these providers is permitted by us to use your content for advertising, and we never sell resident or family data.
- If a change of provider would materially change how your data is handled, we notify community administrators before it happens.
Questions about any provider: patrick@porchlight.ing.
See also: Security · Data Processing Addendum · HIPAA & BAAs