Subprocessors
Effective Date: March 16, 2026
Last Updated: March 16, 2026
Introduction
This page lists the third-party service providers ("subprocessors") that Surkyl uses to process personal data on behalf of our customers. We maintain this list in accordance with GDPR Article 28 and as part of our commitment to transparency.
A subprocessor is a third-party data processor engaged by Surkyl who has or potentially will have access to or process personal data. We only engage subprocessors who provide sufficient guarantees to implement appropriate technical and organizational measures to ensure processing meets legal requirements.
For details on how we collect, use, and protect your data, please see our Privacy Policy.
Current Subprocessors
The following subprocessors are currently authorized to process personal data on behalf of Surkyl:
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Cloudflare | CDN, DNS, R2 Object Storage, Pages (Static Hosting), Workers (Edge Computing) | All traffic, stored files (stems, audio, projects), static site hosting | Global (US primary) |
| Google Cloud | Cloud Run (compute hosting), Vertex AI (AI features), OAuth authentication | Application data, user prompts, content for AI analysis, email address, name, profile picture (Google Sign-In) | United States |
| Linode (Akamai) | Infrastructure hosting | All application data | United States |
| Anthropic | AI features | User prompts, content for AI analysis | United States |
| OpenAI | AI features | User prompts, content for AI analysis | United States |
| LALAL.AI | Audio stem separation | Audio files submitted for stem separation | European Union |
| Polar.sh | Payment processing, subscriptions, licensing | Payment information, billing address, transaction data, subscription status | United States |
| Resend | Transactional email delivery | Email addresses, names, email content | United States |
| PostHog | Product analytics | Usage data, device information, feature interactions | European Union |
Storage-Specific Information
MueSync stores user files (audio files, stems, project data) on Cloudflare R2 object storage. R2 is a globally distributed storage service with data centers primarily located in the United States. Files are encrypted at rest and in transit.
Changes to Subprocessors
We may update our list of subprocessors from time to time. When we add a new subprocessor or make material changes to how an existing subprocessor processes data, we will:
- Update this page with the new information
- Update the "Last Updated" date at the top of this page
- For enterprise customers with Data Processing Agreements: Provide notice as specified in your agreement
We recommend checking this page periodically for updates. You may also contact us at [email protected] to request notification of subprocessor changes.
Data Processing Agreements
We maintain Data Processing Agreements (DPAs) or equivalent contractual commitments with all subprocessors listed above. These agreements ensure that:
- Subprocessors only process data according to our documented instructions
- Appropriate security measures are implemented
- Data is not transferred to unauthorized parties
- Data subject rights can be fulfilled
- Subprocessors assist with compliance obligations
International Data Transfers
When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions by the European Commission
- Binding Corporate Rules where applicable
Contact Information
If you have questions about our subprocessors or data processing practices, please contact us:
- Privacy Inquiries: [email protected]
- DPA Requests: [email protected]