Sub-processors
The companies that process customer data for Stroop, what each one does, and where. Your database and files stay in the EU; the exceptions are named below.
Last updated 17 October 2026.
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Railway | Hosting: the app, the API, the database and file storage | Everything in your account: study content, responses, recordings, uploads, transcripts | EU (Railway EU West, Netherlands; files in Amsterdam) |
| Cloudflare | DNS for withstroop.com and withstroop.xyz | Domain lookups only. No study content is stored there | Global network |
| AssemblyAI | Transcription and redaction of personal details in transcripts | Audio from recordings, and the transcripts made from it | EU (AssemblyAI's EU endpoint) |
| Anthropic | The AI assistant and AI analysis: summaries, tags, synthesis, report draftsOnly when AI is on for the workspace. Each workspace can switch it off. | Transcripts, answers, notes and diary entries sent for analysis | United States |
| LiveKit | Video rooms for moderated sessions and their recordingOnly for moderated sessions held in Stroop's own room. | Camera, microphone and screen streams of people in the room | EU project; media routes through the nearest edge, recordings are written to our EU storage |
| Resend | Email: sign-in codes, invitations, reminders, receipts | Email addresses, names and the message | United States or EU, per Resend's sending region |
| Stripe | Payments: card and bank transfer collection, invoices | Billing contact, company details, VAT number, payment details. No participant data | United States and EU |
| Twilio | SMS reminders to participantsOnly when a study sends SMS reminders. | Phone number and the reminder text | United States and the destination country |
| Sentry | Error reports from the app | Technical error details and session ids. No participant personal data | EU |
| PostHog | Product analytics on the researcher app, without cookies | Which screens researchers use. Never participant or share pages | EU |
Before we add one
We give customers 30 days' notice before a new sub-processor starts handling their data, so you can object, or leave, before it happens. To be told, email [email protected] with the subject “Sub-processor updates”. Changes are also dated on this page.
What isn't on this list
Integrations you connect yourself, such as Figma, GitHub, Google or Microsoft calendars and Slack, act on your instructions under your own account with them. Video calls you run in Zoom, Teams or Meet stay with those providers; only recordings you upload come to Stroop.
Stroop is the all-in-one research and testing platform. Run usability tests, prototypes, surveys, tree tests, diaries and IATs in one study, and get results back transcribed, scored and charted, with every finding linked to the session it came from. Never Before Seen Ventures Limited is the processor. The data processing agreement covers these sub-processors, and the privacy policy says what Stroop collects.