Sub-processors

Last updated: 2026-09-30

At a glance

  • ✓All primary customer data stored within the EEA
  • ✓Each sub-processor bound by GDPR-compliant data-processing terms
  • ✓14-day advance notice before any new sub-processor is engaged

We use the following third-party providers to deliver 360review.

ProviderPurposeRegion
Amazon Web ServicesHosting, compute, sign-in, file storage, server logsEU (Stockholm)
MongoDB AtlasDatabase for accounts, answers and reportsEU (Stockholm)
SupabaseDatabase for 360s, answers, comments and follow-up 360sEU (Ireland)
Microsoft Azure OpenAIWriting reports and comparisons between 360s; drafting replies to support emails, which a person reviews before sendingEU (Sweden)
UpstashReminder emails and sign-in links (leader name, email, 90-day plan)EU (Ireland)
ResendTransactional email deliveryEU (Ireland), EU-US DPF certified
StripePayment processingEU
Google WorkspaceSupport inbox for emails you send usGlobal

All primary customer data is stored within the EEA. Where data flows outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework as applicable.

We may add new sub-processors as the service evolves. Customers under an active DPA will be notified at least 14 days before any new sub-processor begins processing their data.

To object to a sub-processor or request more detailed information, please contact us.