How we use sub-processors
A sub-processor is a third party that processes personal data on our behalf, in order to deliver the Siren service to you. Our Data Processing Agreement sets out how we hold sub-processors to equivalent data-protection standards, and the change process we follow before adding or replacing any sub-processor (14 days' notice, right to object).
Every sub-processor on this list is bound by a written data-processing agreement with Siren. Where personal data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses or another approved transfer mechanism.
The most recent change to this page: 2026-10-11 — initial publication.
AI / Language models
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| AI model provider (via OpenRouter) | AI model API: powers the Siren Reasoner (copy generation, brand checks). | Prompt text, Brand DNA config, generated copy, sent per request and not used by the provider for training per its paid API terms. | United States | Privacy Policy |
| OpenRouter | LLM routing: forwards Reasoner requests to our AI model provider. | Brief text, Brand DNA config, generated copy, forwarded to our AI model provider; not used for training. | United States | Privacy Policy |
| fal.ai | Image and music generation: paints each still and generates music beds. | Image prompts built from your prompt and Brand DNA, your logo and reference images, sent per request. | United States | Privacy Policy |
| Cartesia | Text-to-speech: synthesises the spoken voices used in quality scoring debate mode. | Generated copy submitted for speech synthesis. No account identity is sent; audio is not retained for model training. | United States | Privacy Policy |
Hosting and infrastructure
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Contabo | Sage VPS: virtual private server that hosts all Siren application services, the PostgreSQL database, and the Redis cache layer. | All application data at rest, including user accounts, workspace config, brief history, generated assets (metadata), and encrypted OAuth tokens. | European Union (EU data-center) | Privacy Policy |
Asset storage
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Cloudflare R2 | Object storage for generated asset files (PNG, MP4, carousel frames). Assets are partitioned by workspace ID. | Generated image and video files, workspace-isolated. No personal data included in the files themselves unless Customer embeds personal content in a brief. | Configurable; EU-region bucket used by default. | Privacy Policy |
Payments
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Stripe | Payment processing, subscription management, invoicing. | Payment card data (processed directly by Stripe; we never see raw card numbers), billing name and address, Stripe Customer ID, subscription status. Stripe acts as an independent data controller for its own fraud and compliance purposes. | United States (Stripe processes globally) | Privacy Policy |
Transactional email
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Resend | Sending transactional emails: account confirmations, billing receipts, breach notifications, product announcements. | Recipient email address, message body, delivery metadata (opens, bounces). | United States | Privacy Policy |
CDN and networking
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Cloudflare | DNS, reverse proxy, DDoS protection, and CDN for all public-facing Siren domains (mysiren.ai and subdomains). | Request metadata at the network layer: source IP, user-agent, request URL, response code. Cloudflare does not see unencrypted payload data for API routes. | Global CDN edge nodes; Cloudflare is a US entity. | Privacy Policy |
Advertising partners (only with cookie consent)
| Provider | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Meta Platforms, Inc. | Ad measurement and delivery: the Meta pixel and the Conversions API tell us which Meta ads bring paying customers. Meta acts as an independent controller for this data. | With cookie consent only: page views, signups and checkouts started; for purchases, a SHA-256 hash of the email and workspace id, Meta cookie ids, amount and currency. | United States | Privacy Policy |
| X Corp. | Ad measurement: the X pixel and the X click id tell us which X ads bring customers. X acts as an independent controller for this data. | With cookie consent only: page views and signups via the X pixel; the X click id from the ad's link. | United States | Privacy Policy |
Self-hosted services
The following components are not third-party sub-processors — they are services we run ourselves on Siren-controlled infrastructure (the Contabo Sage VPS). They are listed here for completeness and because they are significant stores of customer data.
| Service | Purpose | Data stored | Notes |
|---|---|---|---|
| PostgreSQL 15 | Primary relational database. Stores all structured application data: user accounts, workspaces, campaigns, briefs, asset metadata, Brand DNA config, subscription state. | All structured personal data processed by the service. No data leaves the Sage VPS except via explicit API calls to sub-processors listed above. | Self-hosted on the Contabo Sage VPS. No third-party SaaS database is in use. |
| Redis | Cache and job queue. Stores short-lived session tokens, rate-limit counters, and background-job state. | Encrypted session tokens (no plaintext personal data cached), rate-limit keys (hashed identifiers), job payloads (may reference workspace IDs). | Self-hosted on the Contabo Sage VPS. Data is volatile: TTLs are short, and nothing in Redis is treated as a system of record. |
All self-hosted services inherit the security measures described in the DPA Security section: disk encryption, TLS on all internal connections, access restricted to authorized Siren personnel.
Change process
Before adding, replacing, or removing a sub-processor, we will:
- Update this page with the proposed change marked "pending".
- Email the workspace owner address on file with at least 14 days' notice, including the sub-processor name, purpose, data category, and location.
- Accept written objections at [email protected] within 14 days of the notice.
- After the 14-day window (or sooner if all customers have confirmed acceptance), mark the change live on this page with the effective date.
Customers with contractual requirements for stricter notice or prior approval should contact [email protected] to negotiate a customer-specific addendum.
Contact
Questions about sub-processor use: [email protected]
To object to a pending sub-processor change: [email protected] — subject line "Sub-processor objection — [provider name]".
Security concerns about any sub-processor: [email protected]