Trust Center · Subprocessors
Every third party that handles your data.
The companies and services that process customer data for CM Chat, what each one does, which data it sees and where. List dated October 2026.
Last reviewed October 2026
The list
As of October 2026.
Operated by Image Depot LLC. Customer content is protected before it is stored.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc.Hosting and network | Runs the application and the database, stores files and backups, keeps real-time connections open, runs queues, serves the website, and provides network security and DNS. | All workspace data, stored protected, and processed on Cloudflare machines while a request is served. Network addresses and request metadata. | Cloudflare's global network. We do not pin storage to a country. |
| Cloudflare, Inc. (Email Service and Email Routing)Sending and receiving email | Sends sign-in codes, invitations, notifications and email summaries. Receives email sent to our addresses and, where a workspace has turned it on, to channel addresses. | Recipient address, subject and body. Sign-in codes and invitation links are in the body. Summaries and notifications can include a short message preview unless previews are turned off. Inbound messages sent to us. | Cloudflare's global network. |
| Cloudflare, Inc. (Turnstile)Bot check | Checks that sign-in and contact forms are filled in by a person. | A one-time token from the visitor's browser and the visitor's network address. No message content. The widget talks to Cloudflare directly from the visitor's browser. | Cloudflare's global network. |
| Cloudflare, Inc. (public DNS resolver)Webhook address check | When an admin sets up an outgoing webhook, CM Chat checks the destination address is a safe, public one. | The host name of the webhook address only. | Cloudflare's global network. |
| Google LLC (Firebase Cloud Messaging)Android push notifications | Delivers notifications to the CM Chat Android app for people who install it and allow notifications. | The device token, the workspace name, the channel name (or "direct message"), internal ids and a time. Never message text, whatever the preview settings say. The notification text is generic, such as "New message in #channel". | Google's infrastructure; Google decides the processing location. |
| Browser push services (Google, Mozilla, Apple, Microsoft)Browser push notifications | Delivers notifications to browsers whose user has allowed them. Which service is used depends on the person's browser, and CM Chat will send only to those four families of services. | The notification. It can contain a short message preview unless previews are turned off by the workspace or the person. The push service sees delivery metadata. | The browser maker's infrastructure. |
Notes
What the list does and does not include.
- Destinations you choose
- If an admin sets up an outgoing webhook, CM Chat sends the events they pick to the address they enter. That recipient is the customer's choice, not our subprocessor.
- Email you read elsewhere
- Email is plain text by nature. Once a message reaches your own mail provider, it is governed by that provider.
- Calls
- Voice and video calls are not available today. Before they are switched on, the call-media provider will be added to this list.
- Other services
- The website and the apps use no advertising, analytics or tracking services, and no third-party scripts or fonts.
- How we change the list
- When a provider is added or removed, this page is updated and the date at the top changes. To be told about changes, write to hello@cmchat.app.
Questions from your security team?
Write to hello@cmchat.app and a person will reply. To report a vulnerability, write to security@cmchat.app (see how to report, and security.txt).
Detailed security documentation is available on request: security@cmchat.app.
Schools and districts: talk to us about your district's requirements. We would rather answer a specific question than hand you a badge.