Effective Date: August 15, 2026
1. PURPOSE
The Company engages carefully selected third-party service providers (“Subprocessors”) to support the delivery, security, and reliability of the Platform. This document provides transparency into those subprocessors that process Customer Personal Data on behalf of the Company.
Maintaining this list supports compliance with:
GDPR (General Data Protection Regulation)
UK GDPR
CCPA (California Consumer Privacy Act, where applicable)
Standard Data Processing Agreements (DPAs)
2. DEFINITION OF SUBPROCESSOR
A Subprocessor is a third party engaged by the Company that processes Customer Personal Data on behalf of the Company.
This includes vendors who:
Store Customer Personal Data (e.g., database hosting).
Transmit Customer Personal Data (e.g., email delivery).
Have potential logical access to production systems where Customer Personal Data resides.
Provide infrastructure on which Customer Personal Data is hosted.
Clarification:
Vendors that do not have access to or process Customer Personal Data (for example, internal project management tools, billing platforms without production access, or analytics tools configured to anonymize data) are not classified as Subprocessors.
3. CURRENT SUBPROCESSORS
The following entities are currently engaged by the Company to process Customer Personal Data:
1. Amazon Web Services EMEA SARL
Purpose: Cloud Infrastructure & Hosting
Data Processed: Customer Personal Data (Encrypted)
Location: EU (Frankfurt) / Global
Safeguards: SOC 2 / ISO 27001
2. Google Cloud EMEA Limited
Purpose: Cloud Services & Analytics
Data Processed: Customer Personal Data
Location: EU / Global
Safeguards: SOC 2 / ISO 27001
3. Cloudflare, Inc.
Purpose: Performance, WAF & Security
Data Processed: Technical Personal Data (IPs, Logs)
Location: Global / Anycast
Safeguards: SOC 2 / ISO 27001
4. Stripe Payments Europe, Ltd
Purpose: Payment Processing
Data Processed: Billing & Financial Data (PCI)
Location: USA / Global
Safeguards: PCI-DSS Level 1
5. UAB "Neopay"
Purpose: Open Banking (Bank Links)
Data Processed: IBAN & Transaction Data
Location: EEA (Lithuania)
Safeguards: PSD2 / ISO 27001
Note: For security reasons, detailed facility information (such as specific data center addresses) is not publicly disclosed. All providers maintain SOC 2 Type II or ISO 27001 certifications.
4. DUE DILIGENCE & VENDOR SELECTION
Before engaging a Subprocessor, the Company performs a risk-based security and privacy assessment. This due diligence process typically includes:
Review of SOC 2 Type II or ISO 27001 certifications.
Analysis of the vendor's security documentation and business continuity plans.
Evaluation of privacy posture and GDPR/CCPA alignment.
Review of historical breach data and incident response capabilities.
Vendor Lifecycle Management:
The Company maintains a vendor inventory and periodically reassesses Subprocessors based on risk. All subprocessors are required to enter into written Data Processing Agreements (DPAs) with the Company that impose data protection obligations substantially equivalent to those maintained by the Company.
5. INTERNATIONAL DATA TRANSFERS
Where a Subprocessor processes Customer Personal Data outside the European Economic Area (EEA), the Company implements appropriate safeguards to legitimize the transfer, such as:
Standard Contractual Clauses (SCCs) approved by the European Commission.
Adequacy Decisions issued by the European Commission.
UK International Data Transfer Addendum (where applicable).
Data Privacy Framework (DPF) certification (where applicable).
Where required by applicable law, transfer impact assessments (TIAs) are performed to evaluate the effectiveness of these safeguards.
6. SUBPROCESSOR CHANGES AND NOTIFICATIONS
The Company reserves the right to update this Subprocessor list to reflect changes in our infrastructure, vendor relationships, or service offerings.
Notification Mechanism: Customers may subscribe to receive notifications of Subprocessor updates via the Company’s Trust Center or designated email alerts.
Review Responsibility: Customers are encouraged to review this page periodically to stay informed of any changes. The current version of this Subprocessor list is maintained in the Company’s Trust Center.
Emergency Replacements: The Company may replace a Subprocessor without advance notice where the reason for the change is outside of the Company’s reasonable control (e.g., bankruptcy, sudden discontinuance of service, or material security breach of the Subprocessor). In such cases, the Company will notify the Customer as soon as reasonably practicable.
7. CUSTOMER RIGHTS AND OBJECTIONS
Where required by applicable law or contractual agreement (such as a signed DPA), Customers may object to the appointment of a new Subprocessor on reasonable data protection grounds.
Upon receiving a valid objection in writing, the Company will:
Work in good faith with the Customer to address the concern.
Provide additional safeguards or alternative configurations where feasible.
If no reasonable resolution is possible, allow the Customer to terminate the affected services in accordance with the termination provisions of the governing agreement.
8. SECURITY RESPONSIBILITY & LIABILITY
While the Company carefully selects its Subprocessors, it remains responsible for protecting Customer Personal Data and ensures that subprocessors are contractually bound to appropriate security and confidentiality obligations. The Company remains liable for the acts and omissions of its subprocessors to the extent required by applicable data protection law.