Sub-processors
Last Updated: October 31, 2026 Thomas Abram, LLC | privacy@abram.network
These are the third parties that process personal data for ABRAM. This list forms part of our Privacy Policy and is Annex 3 of our Data Processing Addendum. Each provider's agreement with ABRAM includes data processing terms that address GDPR Article 28, except the one exception marked below. Integrations marked only when connected receive no data until a customer turns them on.
Notice of changes. We give at least 30 days' notice before a new sub-processor processes customer personal data, by updating this page and by email to everyone who has asked for notices. To ask, write to privacy@abram.network.
| Sub-processor | What it receives | Purpose | Region |
|---|---|---|---|
| Vercel Inc. | Request data (IP address, browser details, page addresses) for both surfaces; marketing site page views, after a visitor allows analytics | Hosting and content delivery for the Platform and the marketing site; marketing site analytics | US, with content served from Vercel's global edge network |
| Supabase Inc. | All Platform data and files; marketing site subscriber, sales contact and visit data | Database, file storage, row-level security, background jobs, and embeddings for search and work profiles | US (AWS us-east-2 for the Platform; us-west-2 for the marketing site) |
| Cloudflare, Inc. | Video and other files a workspace uploads, their review copies and previews; file names and workspace, project and file IDs; IP address and browser details of people who play a review copy | File storage for uploads and video review, and delivery of review playback | US (storage held in Cloudflare's US jurisdiction; playback delivered from Cloudflare's global network) |
| Modal Labs, Inc. | Uploaded video and its sound, workspace, project and file IDs; the words typed into an ABRAM Vision footage search (not stored) | Making review copies of uploaded video; for ABRAM Vision and transcripts, only when a project manager starts a run, picture and sound analysis and speech-to-text; turning a footage search into a search by picture | US |
| Google LLC (Google Cloud) | Low-resolution frames from footage (no sound), the project's shot list and plan details, and transcript text; where used, the words typed into an ABRAM Vision footage search (not stored) | ABRAM Vision footage checks, only when a project manager starts a run; footage search | US |
| WorkOS Inc. | Name, email, organization membership, identity provider attributes, sign-in and session events, integration connection tokens; sign-ins and access grants for AI clients a person connects to ABRAM | Authentication, SSO, SCIM, integration connections; sign-in for connected AI clients | US |
| Stripe Inc. | Name, email, phone, billing address, tax identifiers, payment method details (held by Stripe), transactions, payouts, AI usage quantities. Stripe collects identity verification for payouts directly. | Subscriptions, invoices, payment processing and payouts | US and EU |
| Anthropic, PBC (commercial API) | Content passed to AI features: messages and chat history, briefs, scripts, call transcripts, documents, resumes, deliverable feedback, crew names, roles and rates, suggestion scores, the working-patterns summary for people who opted in, and web search queries. Work profiles are not built with Anthropic. | AI inference for product features | US |
| Anthropic, PBC (Claude subscription) Exception: no data processing agreement | Platform data that ABRAM's internal AI agents and staff AI tools read while they work, including error reports with user IDs and page addresses, product usage events, project records, and marketing contact data | ABRAM's internal AI agents and staff AI tools: error triage and fixes, change review, research, and marketing work. Runs under Anthropic's terms for its Claude subscription service, not the commercial API terms, with the setting that lets Anthropic use conversations to improve its models turned off. Anthropic does not offer a data processing agreement for this service. You may object under Section 7.3 of the Data Processing Addendum. | US |
| Functional Software, Inc. (Sentry) | Error messages, stack traces, page addresses with access links removed, browser and device data, IP address. No user ID or email. | Error and performance monitoring in the Platform, after a user allows analytics | US |
| Resend | Name, email address, email content (including client portal sign-in codes and data export links), marketing contact details (phone, address, company, role, plan), delivery events | Transactional, product and marketing email | US |
| Microsoft Corporation (Microsoft 365) | Email sent to ABRAM's company addresses, including names, email addresses, request details and attachments, and error alert email | Company email for support, privacy, security and sales requests | Being confirmed |
| Apple Inc. (Apple Push Notification service) | Device token, and notification title and text, which can include names, timecard updates and message previews | Push notifications for the iPhone app, only on a device that turns them on | US |
| GitHub, Inc. | Error reports, which may include a user ID, page address and error message, and the Platform data ABRAM's internal AI agents read while they work | Source code hosting; runs ABRAM's internal AI agents | US |
| Slack Technologies, LLC | Slack user IDs, name and email address (to link a Slack identity), notification and check-in content; for ABRAM's own workspace, new signups' name, email and account type, event contact card submissions, and error summaries | Notifications and check-ins, only when connected; internal operations alerts | US |
| Google LLC (Analytics) | Page views, device and browser data, coarse location derived from IP address, consent choices | Marketing site traffic measurement. In the EEA, the UK and Switzerland, only after a visitor opts in | US |
| Mux Inc. | Playback and delivery data, including IP address and player metrics | Video hosting and streaming for demonstration videos | US |
| Atlassian (Jira), Asana, Inc., monday.com Ltd. | Projects, tasks, assignee names and emails, and Jira account IDs, read from the customer's own account | One-way project import, only when connected | Per the customer's own account with the provider |
| Zoom Video Communications, Inc., Google LLC (Meet) | Meeting details, transcripts and participant names | Call transcript import, only when connected. Not offered in the app today. | US |
AI clients you connect. A person on a paid plan can connect an AI client they use, such as Claude or ChatGPT, to ABRAM. The company that provides that client receives ABRAM's answers to the requests it makes, under that person's own agreement with it. It is not ABRAM's sub-processor: it is a recipient the person chooses, as described in Section 4.8 of the Privacy Policy.
Advertising. Meta Platforms, Inc. (and, for the EEA, the UK and Switzerland, Meta Platforms Ireland Limited) receives visit data from the Meta Pixel on abram.network, and a hashed record of each new signup, for advertising, unless the visitor opts out. Meta is not a sub-processor: it receives this as a third party under its own terms, as Section 6 of the Privacy Policy describes. Nothing about a person's work in the Platform is sent to Meta.
Embedded content. Some pages load content from other companies that are not our sub-processors and receive only what a browser sends when it loads their content: YouTube thumbnails and Google Fonts on public link pages, placeholder avatars from ui-avatars.com (which receives a person's initials), and, in the iPhone app, a document-reading component from cdnjs (Cloudflare) when a resume is imported.
Changes on October 31, 2026. Vimeo.com, Inc. was removed: ABRAM no longer plays video in Vimeo's player and sends Vimeo nothing. A version saved earlier as a Vimeo link is shown only as a link, which opens on Vimeo's own site.
Changes on October 27, 2026. No sub-processor was added or removed. The Advertising note above was added for the Meta Pixel. Modal and Google Cloud also receive the words typed into an ABRAM Vision footage search, which ABRAM does not store, and WorkOS also handles sign-in for AI clients a person connects to ABRAM.
Changes on October 23, 2026. Adobe Inc. (Frame.io) was removed: ABRAM no longer connects to Frame.io and sends it nothing.
Changes on October 19, 2026. Cloudflare, Inc., Modal Labs, Inc. and Google LLC (Google Cloud) were added for file and video uploads, video review, transcripts and ABRAM Vision. For workspaces created before October 19, 2026 they process customer personal data from November 18, 2026, or sooner only where a workspace admin turns video uploads on. Workspaces created on or after October 19, 2026 use them from the start.
Changes on October 11, 2026. Mintlify, Inc. was removed: ABRAM's help center no longer runs on it. The Anthropic entry was split in two, to show separately the terms ABRAM's internal AI agents run under. That processing is not new.