Sub-processors

List date: October 20, 2026

This page lists the third parties that process customer data for SigmaShake services. The Data Processing Agreement (DPA), Section 7, uses this list.

Where the list lives

• This page is a pinned copy of the list as of the list date.
• The machine-readable list is at compliance.sigmashake.com/api/v1/sub-processors.json. That list is the current source. It can name more uses than this page.
• The list is also at sigmashake.com/sub-processors.

Current sub-processors

Sub-processor	Purpose	Data category	Region	DPA status
Cloudflare	Hosting and delivery for sigmashake.com and the SigmaShake services. This includes compute, storage, CDN, WAF, DNS, inbound email routing, Workers AI, and the Turnstile bot check.	Request metadata (IP address, user agent), account and session records, product usage events, voice-demo audio sent for transcription, bot-check tokens.	USA. SCCs apply for EEA data.	DPA on file
Stripe	Subscription billing and payment processing.	Billing contact, payment details (Stripe holds these, not SigmaShake), subscription status.	USA	DPA on file
GitHub	Source hosting. GitHub App and OAuth sign-in for staff and customers.	Source code and infrastructure configuration. GitHub account identifiers.	USA	DPA on file
Anthropic	AI inference. This covers homepage chat, rule drafting, support-ticket triage and draft replies, and inbound sales-email classification.	Chat and rule-drafting prompts. Support-ticket subject and message text. Sales-inquiry sender name, email address, subject, and message text.	USA	DPA on file
Resend	Delivery of transactional email, for example account and support messages.	Recipient email address and message content.	USA	DPA on file
Google	Measurement of visits to sigmashake.com pages with Google Analytics 4. Google Fonts.	Page views, browser and device metadata, and the IP address that the visitor's browser sends.	USA	DPA and transfer assessment pending
jsDelivr	Public CDN for third-party browser libraries (asciinema player, Swagger UI) on the hub, build, and vcs pages.	Visitor IP address, user agent, and referrer.	Global CDN	DPA and transfer assessment pending

Notes on the table

• Google Analytics 4 runs in Consent Mode v2. Consent is denied by default. No consent banner exists, so Google Analytics sets no cookies and sends cookieless pings only.
• "DPA and transfer assessment pending" means the work is not finished. SigmaShake does not claim the SCCs for these vendors. See DPA Section 8.
• SCCs are recorded only for Cloudflare. No transfer impact assessment record exists yet.
• This list has 7 sub-processors as of 2026-10-20. Rule drafting uses Anthropic.
• SigmaShake does not make a data-residency commitment for Cloudflare storage. Organizations share the Fleet database by default.

Not sub-processors

You can connect these platforms to your account. They receive the data that you send through them. They are not SigmaShake sub-processors:

• Google Sign-In and YouTube
• Twitch
• Kick
• Reddit
• Microsoft
• Apple
• X
• Discord
• NVIDIA (only with your own key)

This list does not cover the Sigma Ups arcade. The Sigma Ups privacy policy names its processors.

Changes to the list

• SigmaShake updates this page and the machine-readable list when the set of sub-processors changes.
• The updated list is the notice of a change.
• Email notice of changes is not available today. No RSS or Atom feed exists.
• You may object to a new sub-processor on reasonable data-protection grounds. Send the objection within 30 days of the list update.
• SigmaShake will work with you in good faith to resolve the objection. If no resolution is possible, SigmaShake may end the relevant service. See DPA Section 7.

Removed sub-processors

• Cerebras removed as a sub-processor on 2026-10-20.

Contact

For a question about this list, write to [email protected]. For a security matter, write to [email protected].