Subprocessor List
Effective date: September 15, 2026
This page lists the vendors RedHold LLC ("Diagrams.so", "we") uses to provide the Services. It is referenced by the Privacy Policy and forms Annex III of the Data Processing Addendum.
Data categories used below:
- Customer Content: prompts, diagram content and versions, files you submit, transient voice audio, and generated Outputs.
- Account data: email, name, authentication identifiers, plan, billing metadata, and the usage and Credit ledger.
- Visitor data: website analytics data such as IP address, device and browser information, page events, and, with consent, session recordings.
Subprocessors
| Vendor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Anthropic, PBC | AI diagram generation | Customer Content | USA | Data Privacy Framework; Standard Contractual Clauses as fallback |
| OpenAI, LLC | AI diagram generation | Customer Content | USA | Data Privacy Framework; SCCs as fallback |
| Microsoft Corporation (Azure AI services) | AI diagram generation and voice transcription (audio is not stored) | Customer Content, including transient voice audio | USA | Data Privacy Framework; SCCs as fallback |
| Amazon Web Services, Inc. | Hosting and infrastructure: compute, database, storage, CDN, caching, secrets management, and transactional email | Customer Content, Account data, Visitor data (as host of our systems) | USA | Data Privacy Framework; SCCs as fallback |
| Stripe, Inc. | Payments, subscriptions, checkout, and the billing portal | Account data and payment metadata; we never store full card numbers | USA | Data Privacy Framework; SCCs as fallback |
| PropelAuth, Inc. | Authentication and identity, including Google, Microsoft, and GitHub single sign-on | Account data | USA | Standard Contractual Clauses |
| Google LLC | Website analytics (with consent) and reCAPTCHA abuse protection on authentication pages | Visitor data | USA | Data Privacy Framework; SCCs as fallback |
| Microsoft Corporation (Clarity) | Website session recordings and heatmaps (with consent) | Visitor data | USA | Data Privacy Framework; SCCs as fallback |
| PostHog, Inc. | Server-side product analytics (pseudonymous usage events) | Account data (pseudonymous identifiers and usage events) | USA | Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Server-side error monitoring | Account and technical data in error reports | USA | Data Privacy Framework; SCCs as fallback |
Notes:
- On our servers, only the AI providers named above and AWS handle Customer Content. The analytics vendors receive Visitor data only; they never receive the content of your prompts or diagrams.
- AI providers delete API content on a default schedule under their agreements with us, retain flagged content longer only for trust-and-safety or legal reasons, and are contractually restricted from training models on content submitted through our accounts.
- Client-side, the in-browser diagram editor is the draw.io editor embedded from embed.diagrams.net (JGraph Ltd), which receives diagram content for rendering in your browser, and custom icon libraries load from GitHub. These load in your browser rather than being engaged by our servers, and are disclosed in the Privacy Policy and Cookie Notice.
- The API, the MCP server, and the SDKs introduce no additional subprocessors and no third-party analytics.
Changes to this list
Before engaging a new subprocessor that will process Customer Content, we update this page with a dated entry in the changelog below and, for customers under the Data Processing Addendum, give 30 days' advance notice by email with a right to object as the DPA describes.
Changelog
- September 15, 2026: First publication of this list.
Questions: privacy@diagrams.so.