{
  "last_updated": "September 11, 2026",
  "last_updated_iso": "2026-09-11",
  "notice_period_days": 30,
  "sub_processors": [
    {
      "name": "OVH Cloud SAS",
      "function": "Compute hosting",
      "location": "France (EEA)",
      "transfer_basis": "Within EEA"
    },
    {
      "name": "Wasabi Technologies, Inc.",
      "function": "Object storage (primary, eu-central-2)",
      "location": "EEA",
      "transfer_basis": "Within EEA"
    },
    {
      "name": "Wasabi Technologies, Inc.",
      "function": "Object storage replica (us-east-1, DR)",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Cloudflare, Inc.",
      "function": "CDN, DNS, WAF",
      "location": "Global",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Stripe, Inc.",
      "function": "Payment processing (merchant's own account, restricted key)",
      "location": "USA, EEA, India",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Razorpay Software Pvt Ltd",
      "function": "Payment processing (India)",
      "location": "India",
      "transfer_basis": "India DPDP-compliant"
    },
    {
      "name": "Dodo Payments",
      "function": "Merchant-of-Record payment processing",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Adyen N.V.",
      "function": "Payment processing (merchant's own account, Hosted Checkout)",
      "location": "Netherlands (EEA), global acquiring",
      "transfer_basis": "Within EEA; EU SCCs, Module Three outside the EEA"
    },
    {
      "name": "Resend, Inc.",
      "function": "Transactional email",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Postmark / ActiveCampaign",
      "function": "Transactional email fallback",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "GitHub, Inc. (Microsoft)",
      "function": "Source control and container registry",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Google LLC (Workspace)",
      "function": "Identity and productivity",
      "location": "USA and global",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "1Password.com, Inc.",
      "function": "Secrets vault",
      "location": "Canada",
      "transfer_basis": "Adequacy decision"
    },
    {
      "name": "Slack Technologies LLC (Salesforce)",
      "function": "Team communication",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Sentry (Functional Software)",
      "function": "Error tracking",
      "location": "USA",
      "transfer_basis": "EU SCCs, Module Three"
    },
    {
      "name": "Sprinto Technologies",
      "function": "Compliance automation",
      "location": "India",
      "transfer_basis": "India DPDP-compliant"
    }
  ],
  "change_log": [
    {
      "date": "2026-09-11",
      "summary": "Added Adyen N.V. Payment processing on the merchant's own Adyen merchant account, available to merchants since the September 2026 launch, classified on the same basis as Stripe, Razorpay and Dodo Payments."
    },
    {
      "date": "2026-09-11",
      "summary": "Corrected the Stripe entry. Stripe processing runs on the merchant's own Stripe account through a restricted key the merchant supplies, not Stripe Connect. No sub-processor was added, replaced, or removed."
    },
    {
      "date": "2026-05-30",
      "summary": "Initial public publication of sub-processor list (Version 1.0)."
    }
  ]
}