Subprocessors
Eight companies process personal data for Shuttio. Three of them can receive the records you migrate; the other five see account, billing, job or usage data only.
Last updated: 14 October 2026
The list
This is Annex III of the Data Processing Addendum. A vendor appears here only if the code calls it.
SubprocessorPurpose, data and location
VercelVercel Inc.Hosts the application and runs its server functions.Data: Records pass through the functions while a migration runs and are not stored there. Request and function logs hold ids and counts, never records or credentials, and are kept for at most 3 days.Location: Cleveland, Ohio, United States (region cle1)Transfer mechanism: EU–US Data Privacy Framework (certified) and Standard Contractual Clauses in its DPA.Receives your records: yes, as described under Data
NeonNeon (Databricks, Inc.)Postgres database.Data: Account data, encrypted credentials, and per-migration bookkeeping: ledger of created ids, source-to-destination id map, failed-row receipts, mapping. Also an uploaded CSV while it is held, an Odoo import package or app queue while it is held (both encrypted), and the Fields step cache (encrypted, deleted within 48 hours).Location: AWS us-east-2, Ohio, United StatesTransfer mechanism: EU–US Data Privacy Framework (Databricks, certified) and Standard Contractual Clauses in its DPA.Receives your records: yes, as described under Data
AnthropicAnthropic PBCClaude guesses the type of each column in an uploaded CSV, and answers questions in the help chat.Data: Per CSV column: its name, at most three sample values cut to 80 characters, and a count of distinct values when there are 25 or fewer. For the help chat: product documentation, the messages you type, and on a migration page a summary of counts and statuses with no record value. Anthropic does not train on API inputs and deletes them within 30 days.Location: United StatesTransfer mechanism: Standard Contractual Clauses in its DPA; Data Privacy Framework as stated on our privacy policy.Receives your records: yes, as described under Data
InngestInngest Inc.Runs migrations as durable background jobs.Data: A migration id. Never credentials or records.Location: United StatesTransfer mechanism: Standard Contractual Clauses in its DPA. It receives a migration id only.Receives your records: no
ResendResendSends account emails and migration completion notices.Data: The recipient's email address and the text of the email: counts and status of a migration, no record values.Location: United StatesTransfer mechanism: Standard Contractual Clauses in its DPA; Data Privacy Framework as stated on our privacy policy.Receives your records: no
StripeStripe, Inc.Takes payment for a CRM migration into Clarify, Odoo, HubSpot, Pipedrive, Breakcold or Twenty.Data: The billing details you enter at Stripe's checkout and the migration number. No CRM records.Location: United StatesTransfer mechanism: EU–US Data Privacy Framework (certified) and Standard Contractual Clauses in its DPA.Receives your records: no
GoogleGoogle LLCGoogle sign-in, if you choose it.Data: The sign-in request. Shuttio receives your Google account id, email address, name and picture. No CRM records.Location: United States and other Google locationsTransfer mechanism: EU–US Data Privacy Framework (certified) and Standard Contractual Clauses in its terms.Receives your records: no
PostHogPostHog Inc.Product analytics: which pages are visited and where a migration flow stops.Data: Page addresses, the referring site and campaign tags, the browser and country, and the steps of the flow (signed up, connected a system, started or paid for a migration) with the system names and price band. The account is identified by an internal user id, never by email. No CRM records, credentials, tokens or email bodies. No session recordings, no form input, no cookies.Location: Frankfurt, Germany (PostHog EU cloud)Transfer mechanism: Standard Contractual Clauses in its DPA. Data is stored in the EU; US-side support access falls under those clauses.Receives your records: no
Systems you connect are not on this list
Attio, Clarify, Odoo, HubSpot, Pipedrive and Affinity are the systems you connect, under your own agreements with them. We read from your source and write to the destination you authorise.
How we announce a change
We email account holders at least 30 days before a new subprocessor receives personal data, and update this page and its date on the day the notice goes out. If you object on reasonable data protection grounds within those 30 days, write to help@shuttio.com. We then either do not use the new subprocessor for your data, or you may end your use of Shuttio and we delete your data as set out in the DPA (section 6).