← TribeROI beta
Sub-processors
Applies to the TribeROI application at app.triberoi.com. This is the canonical list of third parties involved in processing data held in TribeROI, referenced by our data processing agreement.
- Version
- 1.4
- Effective
- 2026-10-17
- Last updated
- 2026-10-16
Sub-processors
Vendors TribeROI sends data to, or stores it with, in order to run the service.
| Provider | Purpose | Personal data involved | Hosting region |
|---|---|---|---|
| Google Cloud Platform | All hosting and storage: application runtime (Cloud Run), database and platform telemetry (Cloud SQL), control plane (Firestore), secrets (Secret Manager), operational logs (Cloud Logging), aggregate benchmark statistics (BigQuery). | All customer and community data, as the infrastructure it lives on. | United States (us-central1; aggregate benchmark statistics in the BigQuery US multi-region) |
| Google Firebase Authentication | Workspace sign-in identity. | The email address and login credentials of workspace users and of anyone who signs in. An identity for a person who never gets access is deleted after 30 days. | United States |
| Anthropic | AI narration: insights, action drafts, and inline explanations, generated only when a workspace user asks. | Aggregate metrics; contribution figures, with your unit values and program costs; event titles, dates and venues; your community’s name, description and industry; the question you type into Explain; your bridges’ names, claims and verdicts; and, for action drafts, numbered rows that describe members by activity and connection counts and the title of the last event they attended. Never community members’ names, email addresses, or text they wrote. Prompts carry only the items listed here, and an automated test checks the prompts that describe individual members. | United States |
| Google Analytics | Counting visits to the sign-in page, where they came from, and whether sign-in and access requests complete. It does not run anywhere in the application once you are signed in. | No email address, no name, and nothing from a workspace. As with any web request, it receives the visitor’s IP address and browser details. In the European Economic Area, the United Kingdom and Switzerland it sets no cookies. | United States |
| Resend | Transactional email: sign-in codes, invitations to the service or to an organization’s workspace, waitlist confirmations and access approvals, and notices to TribeROI’s own team when someone joins the waitlist or is invited to a workspace. | Each recipient’s email address, and their name where we have it, with the content of the email: a sign-in code; for a workspace invitation, the inviter’s name, the organization’s name and the role offered; for a notice to our team, the details a person gave when joining the waitlist, or who was invited to which workspace and by whom. No email is ever sent to community members. | United States |
Connected platforms
Platforms TribeROI reads from on your instruction — using a credential you supply and can revoke, an app you install in your own server, a public feed you point us to, or an export file you upload. Data flows into TribeROI from these platforms; they receive nothing from TribeROI beyond your credential and the queries needed to sync. They appear here for completeness, not because TribeROI discloses data to them.
| Provider | Purpose | Personal data involved | Hosting region |
|---|---|---|---|
| Luma | Event, registration and attendance sync. | Nothing beyond your API key and query parameters; guest data flows inbound. | United States |
| Discourse (your own forum) | Forum topics, posts and reactions sync. | Nothing beyond your admin API key and query parameters; member data flows inbound. Post bodies are read for mention extraction and not stored. | Wherever your forum is hosted |
| GitHub | Repository issues, releases and contributor activity sync. | Nothing beyond your read-only token or app installation and repo paths; activity data flows inbound. | United States |
| DEV.to | Article and comment activity sync. | Nothing beyond your API key and query parameters; activity data flows inbound (DEV.to exposes no member emails). | United States |
| YouTube (Google) | Video and comment activity sync for your own channel. | Nothing beyond your API key and channel id; video and comment data flows inbound. | United States |
| Substack | Post activity from your publication feed. | Nothing beyond your publication address; post data flows inbound. Subscriber lists are never read. | United States |
| Discord | Channel messages, threads and reactions from your server. Scheduled events are not imported. | Nothing beyond the app installation your server grants; member activity flows inbound. Discord exposes no member email addresses. | United States |
| Pipedrive | Deal and contact sync, so a business outcome can be attributed to a member. | Nothing beyond your API token and query parameters; deal and contact data flows inbound. | European Union |
| HubSpot | Won deals, with their contacts, companies and deal owners, so a business outcome can be attributed to a member. | Nothing beyond the read-only app installation your account grants; deal, contact, company and deal-owner data flows inbound. | Wherever your HubSpot account is hosted |
| Slack | Channel messages and member activity from a workspace export file you upload. | Nothing. You export the file from Slack and upload it; no credential is held and nothing is sent to Slack. Message excerpts of up to 280 characters are stored. | Not applicable (file upload) |
| Meetup | Event registration and attendance from an attendee export file you upload. | Nothing. You export the file from Meetup and upload it; no credential is held and nothing is sent to Meetup. | Not applicable (file upload) |
Sources you upload yourself
Some sources reach TribeROI as a file you export and upload — a Slack workspace export, a Meetup attendee list, a CSV. Nothing is sent to those platforms and no credential is held for them, so they are not sub-processors; Slack and Meetup appear in the connected platforms table above only so that the list matches the DPA. The data lands in TribeROI exactly as if you had typed it in.