Applies to the Runway product at v2.cfo.ai; the list for cfo.ai is at cfo.ai/subprocessors. Republished from runway.cfo.ai/privacy/service-providers on October 5, 2026.

To support Runway Financial, Inc. ("Runway") in delivering its FP&A platform Services, Runway engages service providers and subprocessors to assist with data processing activities on behalf of Runway's customers as defined in our Terms of Service and Data Processing Agreement.

What is a Subprocessor?

When Runway engages third party service providers in our capacity as a data processor for our customers' personal data, the General Data Protection Regulation ("GDPR") and other global privacy frameworks call these third-party service providers subprocessors. Subprocessors are service providers who have or potentially will have access to or process personal data that Runway processes for, and on behalf of, Runway's customers.

This page outlines the types of service providers and subprocessors we utilize, where they are located, and a description of the work they carry out.

Due Diligence

Before engaging any service provider (including subprocessors), we perform due diligence, including vendor security assessments. Our service providers are subject to contract terms designed to ensure that these service providers process personal data only for the purposes of providing services to Runway and in accordance with our commitments to customers and applicable data protection laws.

List of Subprocessors

Infrastructure & Data Storage

Core infrastructure providers that store and process customer data.

Snowflake Inc. · United States

Cloud data warehouse for storing and processing customer integration data

Customer integration data including HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), and customer-uploaded spreadsheet data

Google Cloud Platform · United States

Cloud infrastructure provider for Postgres database hosting and backend API services

Customer data, user data, and application data

Vercel Inc. · United States

Frontend application hosting and deployment platform

User interaction data and session information

Google Firebase · United States

User authentication and credential storage

User authentication credentials and user names

Elastic Search · United States

Index and search application data

Customer data, user data, and application data

Cloudflare, Inc. · United States

DNS hosting, CDN, DDoS protection, and traffic proxying for cfo.ai

User IP addresses, HTTP request metadata, and web traffic data processed in transit

AI Services

Services that process customer inputs and related context to power AI features when customers use them.

OpenAI · United States

AI model inference and realtime assistant/explanation features

Customer prompts, uploaded files/attachments, relevant customer data context included in AI requests, and generated outputs, when customers use AI features

Data Integration Services

Services that import customer data when customers actively opt into integrations.

Fivetran Inc. · United States

Data pipeline service for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data - when customers opt in

Merge.dev · United States

Unified API platform for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data - when customers opt in

Workato, Inc. · United States

Integration platform for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data - when customers opt in

Analytics & Monitoring

Services that collect and analyze user behavior and system performance data.

Segment.io · United States

Marketing website analytics and visitor tracking

Website visitor data and marketing analytics data

Amplitude Inc. · United States

Product analytics and user behavior tracking

Product usage data, user interaction data, and user identifiers

Google Analytics · United States

Marketing website analytics and visitor behavior tracking

Website visitor data, user behavior data, and web traffic analytics

Webflow, Inc. · United States

Marketing website hosting, content management, and analytics

Website visitor data and form submissions

Datadog, Inc. · United States

Backend performance monitoring and system observability

Backend performance data, system logs, and potentially user email addresses for error tracking

Sentry · United States

Bug tracking and error monitoring

Error logs, debugging information, and potentially user email addresses

Customer Support & Communications

Services used for customer relationship management and support.

HubSpot, Inc. · United States

Customer relationship management and support ticketing

Customer contact information, support tickets, CRM data, and communication history

Slack Technologies, Inc. · United States

Customer support communications and internal team collaboration

Customer communication data, support conversations, and user information shared in support channels

Google Workspace · United States

Email services and document collaboration with customers

Email communications, shared documents, spreadsheets that may contain customer data, and collaboration data

DocuSign, Inc. · United States

eSignatures

Business User data

Payment Processing

Stripe, Inc. · United States

Payment processing and subscription management

Customer billing information, payment data, and transaction records

Data Residency Services

GDPR Local · United Kingdom

GDPR Article 27 EU/UK Representative services and data protection compliance support

EU and UK customer data that requires local representative services, data protection inquiries, and compliance documentation

Updates to this Page

Due to the nature of our global business and the volume of customers, our business needs and service providers may change from time to time. For example, we may deprecate a service provider to consolidate and minimize our use of service providers. Similarly, we may add a service provider if we believe that doing so will enhance our ability to deliver our Services.

We will periodically update this page to reflect additions and removals to our list of service providers and subprocessors. For more information on Runway's privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us at security@cfo.ai or through our support channels.

For more information on Runway’s privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us.

This version as a PDF: cfo.ai/runway/subprocessors/2026-04-14.pdf.