Last updated: 2 October 2026
Whoosh uses the companies below to run the service. Each one is bound by a written contract with data protection terms at least as strict as our Data Processing Agreement. We add a new provider to this page at least 14 days before it handles customer data. To be told about changes by email, write to support@whoosh.video with the subject “Sub-processor updates”.
Used for every account
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting (Elastic Beanstalk) and PostgreSQL database (RDS), including automated backups | All customer and respondent data, including video | United States |
| Clerk, Inc. | Customer login and session management | Customer name, email address, login metadata | United States |
| Paddle.com Market Limited | Subscription billing and payments, as merchant of record (handles VAT and sales tax) | Billing contact, payment method (held by Paddle only), invoices | United Kingdom / United States |
| Stripe, Inc. | Subscription billing (existing subscribers only) | Billing contact, payment method (held by Stripe only), invoices | United States / Ireland |
| Amazon Web Services, Inc. (Simple Email Service) | Transactional email: new-response notifications, invitations, receipts | Recipient email addresses, campaign names, small video attachments | United States |
| Functional Software, Inc. (Sentry) | Application error tracking and monitoring | Error messages and stack traces, which may include the page URL and non-sensitive request context | United States |
Used only when a customer switches on a feature
These providers receive data only after the account owner connects or enables the feature. Disconnecting the feature in the dashboard stops further transfers; data already copied to the customer’s own cloud folder stays under the customer’s control.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| OpenRouter, Inc. (routing to NVIDIA Parakeet and Google Gemini models) | Transcription of recordings when the customer switches on Transcribe, and automatic translation of campaign instructions when Auto Translate is on | The audio track of recordings (for transcription); campaign copy written by the customer (for translation) | United States |
| Google LLC (Google Drive) | Copying recordings to the customer’s own Drive folder when connected | Video files, file names containing campaign and respondent name | Global |
| Dropbox, Inc. | Copying recordings to the customer’s Dropbox when connected | As above | United States |
| Microsoft Corporation (OneDrive) | Copying recordings to the customer’s OneDrive when connected | As above | Global |
| Box, Inc. | Copying recordings to the customer’s Box account when connected | As above | United States |
| Upstash, Inc. | Distributed rate limiting when configured | Hashed request keys and counters, no personal content | European Union |
| Customer-chosen integrations (webhook endpoints and tools such as Zapier) | Sending response events and share links to tools the customer connects | Whatever the customer maps in that integration | Depends on the tool |
Where video is stored
Recordings live in the production database on AWS in the region shown above, encrypted at rest, and are served through signed, expiring links. Customers on Expert plans can choose “cloud only” per campaign, in which case the file is written to their own storage and not kept by .