Sub-processors

This page is the current, authoritative list of the Sub-processors that VividEngine, LLC (doing business as Fast Technologies) ("Fast") engages to help provide the Services. The list is public and is kept up to date as our Sub-processors change. Once a customer executes our Data Processing Agreement ("DPA"), this list forms part of that DPA, and Section 6 of the DPA sets out the contractual terms that govern Sub-processors, including advance-notice, objection, and termination rights. Other business customers may object as described under Changes and Notifications below.

Current Sub-processors

Customer Content is stored in the United States on servers that Fast owns and operates. Content, or portions of it, reaches the following Sub-processors only as described in their rows below: Cloudflare (edge network, real-time collaboration, and temporary staging of files uploaded through the Fast MCP server, which are deleted when used; an unused staged file becomes unreadable after five minutes and is removed the next time that session stages or uses a file), Google Cloud (AI processing with Gemini and Claude models, and temporary storage of files while AI features process them), Voyage AI (search embeddings), LangSmith (records of AI requests and responses), Brave Search (AI-generated web search queries), CloudConvert (file conversion and previews), SendGrid (notification emails), and PostHog (which may receive limited Content in page titles, page addresses, and error reports). PostHog session replay in the web application masks on-screen text and text-bearing attributes and blocks images and media, and autocaptured clicks omit element text and attributes. PostHog may still receive limited customer content in page titles and page addresses (for example a file, folder, or share name) and in error reports. AI features may process Content through Google Cloud outside the United States, because Gemini and Claude run on Vertex AI's global endpoint; files that Google Cloud stores temporarily while AI features process them are kept in the United States. The remaining Sub-processors receive only the operational data necessary for their specific function and are not provided access to Customer files, though limited file metadata may incidentally appear in operational logs, error reports, or support communications.

Infrastructure

Fast owns and operates its own servers and network, in long-term leased space at a third-party data center. The data center provider is an infrastructure provider, not a data processor, so it is not listed as a Sub-processor. Its certifications are listed in our Trust Center.

Customer-Connected Services

The Sub-processors above are the third parties Fast engages to operate the Services. They do not include third-party services that you choose to connect, or that you direct Fast to connect to, such as MCP (Model Context Protocol) servers, integrations, connectors, and other external tools. When you enable one of these connections, you instruct and authorize Fast to send the relevant data to that service so it can do what you asked of it. You control these connections, they are not Fast Sub-processors, and your use of them is governed by that third party's own terms. See Section 6 of the Data Processing Agreement for details. The file import and sync services you can connect are:

Changes and Notifications

Fast reserves the right to add or change Sub-processors as the platform evolves. We update fast.io/legal/subprocessors at least 15 days before a new Sub-processor begins processing personal data, and at the same time we email customers who have an executed DPA. Business customers may object on reasonable data protection grounds by emailing privacy@fast.io within that period. If we cannot resolve the objection, the customer may stop using the affected Services. Customers with an executed DPA also have the objection and termination rights in Section 6 of that DPA.