Skip to content

Trust · Updated October 27, 2026

Data Processing Agreement

If your company needs a Data Processing Agreement with Headband, we will send you one. This page also lists every provider that processes customer data for us.

Request the DPA

Email support@headband.dev with “DPA” in the subject, your company's legal name, and the address of the person who will sign. If you need specific transfer terms, say so in the same email.

Headband is operated by ZVN DEV LLC. For the documents and searches your app sends to Headband, you decide what is processed and we process it for you. For your account and billing details, we decide, as the privacy policy describes.

Where data is processed

In the United States. Hosted engines run in one region, ewr1 in New York. There is no EU region. The security page has the details.

Sub-processors

  • Vercel: Hosts the website, the dashboard and the API, and runs our scheduled jobs. Data: Every request to headband.dev, including documents and searches sent through the API, and request logs. Location: United States.
  • BataData: Hosts the control-plane database. BataData is also operated by ZVN DEV LLC. Data: Accounts, organizations, projects, API key hashes, usage and search analytics. Location: United States (US East).
  • ReliableSite: Rents us the dedicated server ewr1-a, which runs hosted engines. We operate it. Data: Documents and indexes of hosted engines on that server, on encrypted disks. Location: New York area, United States.
  • Hostkey: Rents us the dedicated server ewr1-b, which runs hosted engines. We operate it. Data: Documents and indexes of hosted engines on that server, on encrypted disks. Location: New York, United States.
  • Backblaze B2: Bucket storage for hosted engines, and the nightly encrypted copy of the control-plane database. Data: Engine data as compressed, encrypted chunks. Database copies encrypted before upload. Location: United States (US East).
  • Cloudflare R2: Stores encrypted backups of hosted engines that are not on bucket storage. Data: Engine backups, encrypted on our server before upload. Location: Chosen by Cloudflare. We set no region..
  • Stripe: Payments, subscriptions and invoices. Data: Billing contact, card details and invoices. Card details go to Stripe and never reach us. Location: Stripe's own infrastructure.
  • JustEmail: Sends our account emails and hosts our support inbox. JustEmail is ZVN DEV LLC's own email platform. Data: Your name and email address, the emails we send you, and what you send us. Location: Operated by ZVN DEV LLC.
  • Little Friend: Analytics, session recordings and error reports on headband.dev. Little Friend is ZVN DEV LLC's own analytics product. Data: Pages viewed and masked recordings. For signed-in users, name, email address and organization. Location: Operated by ZVN DEV LLC.

Sign-in providers

GitHub and Google sign you in. Each sends us the profile details the privacy policy lists. They receive no customer data from us.

Engines you bring

If you connect your own engine, your documents and searches go to it, under your agreement with whoever runs it. We store only its address and credentials, encrypted.

In the code, switched off

The site's code includes Sentry (error reports), PostHog (product analytics) and Resend (newsletter contacts). Production sets no key for any of them, so none receives data. If we turn one on, we will add it to this list first.

Changes to this list

When a provider is added or removed, we update this page and the date at the top. If you have a signed DPA with us, ask us to email you when it changes.