diumIn short
- Most of Dium runs on TAO.ai services: the database proxy, Echo real time, LNBOX email, the file CDN, Moat identity and Werify sign-in.
- Payments go through Werify Paywall. Site analytics is Cloudflare Web Analytics, which uses no cookies.
- We give 30 days' notice before adding or replacing a subprocessor, and you can object.
- Subscribe below to get each notice by email.
Current subprocessors
A subprocessor is a company that processes customer personal data for us, so that we can run Dium. Several are services run by TAO.ai, the company that builds Dium, and shared with other TAO.ai products. Each one is bound by data protection terms at least as protective as our DPA.
| Subprocessor | Purpose | Data | Location | Safeguard | Since |
|---|---|---|---|---|---|
| [Hosting provider] | Runs the Dium web servers (dium.io app, API, sign-in pages) | All customer data in transit and in server caches; IP addresses; logs | [hosting region] | [confirm safeguard] | [confirm] |
| OpsDB proxy (TAO.ai, cachet4.tao.ai) | Database and cache. Every database read and write goes through this proxy | All stored data: accounts, profiles, Flows, posts, direct messages, payments records | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| Echo (TAO.ai) | Real-time delivery of new replies, messages, typing and presence | Message payloads, user IDs, presence | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| LNBOX (TAO.ai, mosaic.tao.ai) | Sends email: digests and invitations | Email address, name, email content | [confirm location and underlying email delivery provider] | Affiliate agreement [confirm] | [confirm] |
| Mosaic LM gateway (TAO.ai, mosaic.tao.ai) | Routes questions from the Dium support assistant to a language model | What you type into the assistant, account context [confirm] | [confirm location and model provider] | Affiliate agreement [confirm] | [confirm] |
| Mosaic network (TAO.ai, mosaic.tao.ai) | Delivers Flow broadcasts (announcements) | Broadcast content, sender | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| TAO.ai CDN (cdn.tao.ai) | Stores and serves uploaded images and PDFs, logos and banners | Uploaded files | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| Moat (moat.page) | Identity and profiles shared across TAO.ai products | Email, Werify key, public key, name, avatar, profile fields, suspension blocks | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| Werify (werify.ai) | Passwordless sign-in and single sign-on | Email, sign-in codes, Werify key | [confirm location] | Affiliate agreement [confirm] | [confirm] |
| Werify Paywall (werify.ai) | Payment checkout for paid plans | Owner name and email, plan, amount, card details (held by Werify Paywall only) | [confirm location] | [COUNSEL: subprocessor or independent controller] | [confirm] |
| Cloudflare Web Analytics (Cloudflare, Inc.) | Cookieless, aggregate page-view statistics | Page URL, referrer, browser, country from IP (not stored as a profile) | United States and global network | Cloudflare DPA with SCCs [confirm] | [confirm] |
Flows running inside a partner's website use the same list. Partners are not our subprocessors; your agreement with them covers what they do.
Other services you may connect to
These services are not our subprocessors, but your browser or our server talks to them in some cases, so you should know about them.
| Service | What it is for | What it sees |
|---|---|---|
| Google Meet, Zoom | Video calls for live sessions | Only when you open a meeting link. Their terms and privacy policies apply |
| YouTube | Videos embedded in Waves or Pages | Loads from YouTube when the video is shown. See the Cookie Policy |
| Google Fonts | Fonts in the Dium app | Your browser requests fonts from Google, which sees your IP address [consider self-hosting app fonts, as the marketing site already does] |
| Google STUN server | Helps two browsers connect for peer-to-peer file sharing | Sees the IP addresses of the two browsers. The file itself goes directly between them |
| OpenStreetMap Nominatim | Turns a place name into map coordinates | Receives the place text only, from our server [confirm when geocoding runs] |
| Partner sites | Organisations that embed Dium or sign their users in | Covered by your agreement with them |
How we tell you about changes
We give at least 30 days' notice before a new or replacement subprocessor starts processing customer personal data. We update this page and email everyone subscribed below. If you are a business customer, you can object within those 30 days on reasonable data protection grounds by writing to [email protected]. If we cannot address the objection, you can end the affected service and get a refund of prepaid fees for the unused period, as the DPA explains.
In an emergency (for example, if a provider fails and we must switch to protect the service) we may make a change sooner, and will tell you as soon as we can.
Get 30 days' notice of changes
We email you before we add or replace a subprocessor. One message per change, nothing else.
You are subscribed
We will email you at least 30 days before any change to this list.
Changelog
| Date | Change |
|---|---|
| September 28, 2026 | First published list [confirm first-publish date] |
Contact
Questions about a subprocessor: [email protected].