Mercemur engages a small number of carefully vetted sub-processors to deliver the platform. Each is bound by a written data processing agreement with security obligations equivalent to those Mercemur owes its customers. We commit to giving customers 30 days' notice before adding or replacing a sub-processor that handles personal data. The current list below is Annex III of our Data Processing Addendum, which is available on request through mercemur.com/contact.
Current sub-processors
| Sub-processor | Function | Location | Transfer basis |
|---|---|---|---|
| OVH Cloud SAS | Compute hosting | France (EEA) | Within EEA |
| Wasabi Technologies, Inc. | Object storage (primary, eu-central-2) | EEA | Within EEA |
| Wasabi Technologies, Inc. | Object storage replica (us-east-1, DR) | USA | EU SCCs, Module Three |
| Cloudflare, Inc. | CDN, DNS, WAF | Global | EU SCCs, Module Three |
| Stripe, Inc. | Payment processing (merchant's own account, restricted key) | USA, EEA, India | EU SCCs, Module Three |
| Razorpay Software Pvt Ltd | Payment processing (India) | India | India DPDP-compliant |
| Dodo Payments | Merchant-of-Record payment processing | USA | EU SCCs, Module Three |
| Adyen N.V. | Payment processing (merchant's own account, Hosted Checkout) | Netherlands (EEA), global acquiring | Within EEA; EU SCCs, Module Three outside the EEA |
| Resend, Inc. | Transactional email | USA | EU SCCs, Module Three |
| Postmark / ActiveCampaign | Transactional email fallback | USA | EU SCCs, Module Three |
| GitHub, Inc. (Microsoft) | Source control and container registry | USA | EU SCCs, Module Three |
| Google LLC (Workspace) | Identity and productivity | USA and global | EU SCCs, Module Three |
| 1Password.com, Inc. | Secrets vault | Canada | Adequacy decision |
| Slack Technologies LLC (Salesforce) | Team communication | USA | EU SCCs, Module Three |
| Sentry (Functional Software) | Error tracking | USA | EU SCCs, Module Three |
| Sprinto Technologies | Compliance automation | India | India DPDP-compliant |
Subscribe to change notifications
Receive a 30-day-advance email any time we add, replace, or remove a sub-processor. We use this list for nothing else and will unsubscribe you on request.
Or write to support@mercemur.com and we'll add you manually.
Change log
- 2026-09-11, Added Adyen N.V. Payment processing on the merchant's own Adyen merchant account, available to merchants since the September 2026 launch, classified on the same basis as Stripe, Razorpay and Dodo Payments.
- 2026-09-11, Corrected the Stripe entry. Stripe processing runs on the merchant's own Stripe account through a restricted key the merchant supplies, not Stripe Connect. No sub-processor was added, replaced, or removed.
- 2026-05-30, Initial public publication of sub-processor list (Version 1.0).
For programmatic consumption, the same list is available as a JSON manifest at /legal/subprocessors.json.
Contact
Questions about our sub-processor program? Write to support@mercemur.com.