Effective from April 13, 2026
Core services supporting all products
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Rapid7 LLC | USA (120 Causeway Street, Suite 400, Boston, MA 02114) | privacy@rapid7.com | The subject matter of the Processing pertains to the provision of cybersecurity monitoring, analysis, and consulting services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is determined by the services agreement with the Sub-Processor. The nature of the Processing involves: monitoring, analysis, and consultation in the process of reviewing cybersecurity alerts or incidents. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Critical Insight, Inc. (Formerly DBA Cl Security) | USA (245 4th St Ste 405 Bremerton, WA 98337) | privacy@criticalinsight.com | The subject matter of the Processing pertains to the provision of cybersecurity consulting services and analysis pursuant to the services agreement with the Sub-Processor. The duration of the Processing is limited to the duration of investigations by the Sub-Processor on cybersecurity incidents. The nature of the Processing involves: consultation in the process of reviewing cybersecurity alerts or incidents. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Databricks, Inc. | USA (160 Spear Street, 13th Floor San Francisco, CA 94105) | privacy@databricks.com | The subject matter of the Processing pertains to the provision of data management platform and analytics services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Flexential Corp. | USA (600 Forest Point Circle, Suite 100, Charlotte, NC 28273) | privacy@flexential.com | The subject matter of the Processing pertains to the provision of co-location data services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval or otherwise making available, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Iron Mountain Inc. | USA (1 Federal Street, Boston, MA 02110, U.S.A) | global.privacy@ironmountain.com | The subject matter of the Processing pertains to the provision of record management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: destruction of shredded paperwork. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Microsoft Corporation. | USA (One Microsoft Way, Redmond, WA 98052) | https://www.microsoft.com/en-us/concern/privacy | The subject matter of the Processing pertains to the provision of Azure Infrastructure services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Navisite, LLC. | USA (400 Minuteman Road, Andover, MA 01810) | privacy@navisite.com | The subject matter of the Processing pertains to the provision of emergency Database Administration (DBA) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: organization, disclosure, erasure. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Okta, Inc. | USA (100 First Street, San Francisco, California 94105) | privacy@okta.com | The subject matter of the Processing pertains to the provision of identity and access management cloud services pursuant to the services agreement with the sub-Processor. The duration of the Processing is generally determined by the services agreement with the sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Pendo.io, Inc. | USA (150 Fayetteville Street, Suite 1400, Raleigh, North Carolina 27601) | gdpr@pendo.io | The subject matter of the Processing pertains to the provision of product analytics to optimize user experience pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Salesforce.com, Inc. | USA (Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105) | privacy@salesforce.com | The subject matter of the Processing pertains to the provision of notifications to CXH users in case of outages pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Twilio, Inc. | USA (375 Beale Street Suite 300 San Francisco, CA 94105) | privacy@twilio.com | The subject matter of the Processing pertains to the provision of an automated emailing system for Syndigo’s customer notification pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Syndigo LLC (for customers entering into the Syndigo Europe DPA) | USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604) | privacy@syndigo.com | The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Syndigo LLC (for customers entering into the Syndigo Europe DPA) | USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604) | privacy@syndigo.com | The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Riversand Technologies Europe AG | Switzerland (Gubelstrasse 11 6300 Zug) | |||
| Riversand Technologies India Private Limited | India (IBC Knowledge Park, Tower D, 8th Floor, Bannerghatta Main Road, Bangalore, Karnataka 560029) | |||
| Microsoft Ireland Operations, Ltd. | Ireland (South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521) | https://www.microsoft.com/en-us/concern/privacy | The subject matter of the Processing pertains to the provision of Azure Cloud services (European MS Azure Cloud) pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage. | N/A |
| Auth0, LLC - wholly owned by Okta | USA (10800 NE 8th Street, Suite 700, Bellevue, WA 98004) | privacy@auth0.com | The subject matter of the Processing pertains to the provision of identity and access management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. | USA (410 Terry Avenue North, Seattle, WA, 98109) 0 Chicago, IL 60604) | https://aws.amazon.com/privacy/ | The subject matter of the Processing pertains to the provision of databases, storage and compute services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage and computational services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Red Hat, Inc. | USA (100 East Davie Street, Raleigh, NC 27601) | privacy@redhat.com | The subject matter of the Processing pertains to the provision of Application Programming Interface Infrastructure (3scale) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, , organization, storage, retrieval for the purposes of delivering the API Infrastructure. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| CloudFlare, Inc. | USA (101 Townsend St. San Francisco CA 94107) | dpo@cloudflare.com | The subject matter of the Processing pertains to the provision of application security and Domain Name System (DNS) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: security analysis of network and application traffic, DNS services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Corporate Name | Country where it is established or from which it may access the Personal data | Subcontracted Services |
|---|---|---|
| Sumologic | United States of America | Application and platform log retention |
| Upwork | United States of America, Colombia, Philippines, Mauritius, Brazil, France, Morocco, Suriname, Dominican Republic | Content Moderation services |
| Amazon Web Services (AWS) | United States of America | Hosting of PowerReviews Platform |
| iOvation | United States of America | Anti-fraud services (based on device information) |
| Wyng | United States of America | Collation of rich media |
| Cloudinary | United States of America and Israel | Image hosting and content delivery |
| Datadog | United States of America | Application and platform log retention |
| United States of America | Display reviews for Google Seller Ratings and/or Google Shopping | |
| Snowflake | United States of America | Hosting provider |
| Sendgrid | United States of America | Consumer facing emails |
| OneTrust | United States of America | DSAR Request facilitation |
| Amazon Cloudfront | United States of America CDN with servers located globally | Content delivery network |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services (AWS) | United States of America, Ireland and United Kingdom. | https://aws.amazon.com/privacy/ | The subject matter of the Processing pertains to the provision of cloud infrastructure and hosting services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage and computational services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Auth0, LLC - wholly owned by Okta | USA (10800 NE 8th Street, Suite 700, Bellevue, WA 98004) | privacy@auth0.com | The subject matter of the Processing pertains to the provision of identity and access management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Anthropic PBC | USA (548 Market St, PMB 90375, San Francisco, CA 94104) Or European Union | privacy@anthropic.com | The subject matter of the Processing pertains to the provision of artificial intelligence and large language model services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: analysis and processing of data to generate AI-assisted outputs. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Please fill out the form below to receive updates on this list.
