Sub-processors

Last updated: 2026-05-08

At a glance

✓All primary customer data stored within the EEA
✓Each sub-processor bound by GDPR-compliant data-processing terms
✓14-day advance notice before any new sub-processor is engaged

We use the following third-party providers to deliver 360review.

Provider	Purpose	Region
Amazon Web Services	Hosting, compute, authentication, file storage	EU
MongoDB Atlas	Primary database	EU
Microsoft Azure OpenAI	AI report generation	EU
Upstash	Operational state (email lifecycle)	EU
Resend	Transactional email delivery	US, EU-US DPF certified
Stripe	Payment processing	EU

All primary customer data is stored within the EEA. Where data flows outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework as applicable.

We may add new sub-processors as the service evolves. Customers under an active DPA will be notified at least 14 days before any new sub-processor begins processing their data.

To object to a sub-processor or request more detailed information, please contact us.