The table below lists every third-party service Developum AI Inc. engages to help operate the EVOLUM platform. Each entry describes what the vendor processes, where they operate, and why we use them. This list is kept current; material changes trigger 30-day advance notice to enterprise customers under our Data Processing Addendum.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Supabase supabase.com |
Managed Postgres database, authentication (JWT), file storage. | Customer account data, project data, uploaded content, session tokens. | US-East |
| Stripe stripe.com |
Subscription billing, payment method storage, PCI-DSS Level 1 compliance. | Payment card details (stored by Stripe, never by us), customer billing address, subscription state. | US / Global |
| Hetzner Cloud hetzner.com |
Application server hosting, network infrastructure. | All application data at rest on Hetzner-managed virtual machines. Encrypted disks. | Germany (Falkenstein) |
| Cloudflare cloudflare.com |
DNS resolution and DDoS protection at the edge. | IP addresses of visitors, request metadata (headers, URLs). No content bodies. | Global |
| fal.ai fal.ai |
Poster and music-cue image/audio generation for the internal EVOLUM asset library. Screenplay content is never transmitted. | Text prompts (genre labels only) and generated media assets. No customer creative content. | US |
| Google Fonts fonts.google.com |
Web font delivery for the marketing surfaces. | Visitor IP for font asset delivery only. | Global |
We do not use, and have never used, the following types of vendors for customer content:
Adding or replacing a sub-processor triggers a 30-day advance notice to enterprise customers under our DPA. Customers may object during that window. If a reasonable objection cannot be accommodated, the affected customer may terminate the affected service without penalty.
To receive advance notice of sub-processor changes, subscribe by emailing security@developumaiengine.com with the subject "Sub-processor Notice."