Subprocessor List
Last Updated: May 2026
The following subprocessors are engaged by PartnerAPI to process personal data on behalf of our customers. All subprocessors are bound by written data processing agreements.
<!-- SUBPROCESSORS:START (auto-generated from docs/gdpr/subprocessors.yaml — run pnpm subprocessors:generate after editing the YAML) -->
Infrastructure & Hosting
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| AWS (S3, SES) | Object storage, email delivery | EU (eu-west-1, eu-north-1) | N/A (EU) |
Monitoring & Observability
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Sentry | Error tracking and monitoring | EU (Frankfurt) | N/A (EU) |
| Grafana Cloud (Loki) | Platform service-log storage and querying — PartnerAPI's own observability only. Customer API logs are not stored here; they live in PartnerAPI's own log infrastructure in AWS eu-north-1. | EU | SCCs |
AI & Machine Learning
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| OpenAI | AI embedding generation, inference, and content moderation for partner-uploaded knowledge documents | US | SCCs + DPA |
| Chroma Inc. (Chroma Cloud) | Vector embedding storage for tenant document content (per-tenant collections used for AI knowledge retrieval) | US | SCCs + DPA (DPA under review) |
Communications
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Mailjet | Transactional email delivery | EU (France) | N/A (EU) |
Billing & Payments
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Stripe | Payment processing and billing | US/EU | SCCs + DPA |
Identity & Integrations
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Atlassian (Confluence + OAuth) | OAuth identity provider; Confluence page content ingestion when the Controller enables the Confluence integration | US | SCCs + DPA |
Analytics
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Google (Google Analytics) | Website analytics on partner-facing pages — page views, sessions, and aggregate usage metrics. Analytics load only after the visitor grants consent via the cookie banner. | US (Google LLC); EU-facing contracting entity Google Ireland Ltd | SCCs + EU-US DPF (DPA under review) |
<!-- SUBPROCESSORS:END -->
Changes to This List
We will notify customers of any changes to our subprocessor list at least 30 days before a new subprocessor begins processing personal data. Customers may object to the appointment of a new subprocessor as outlined in our Data Processing Agreement.
Contact
For questions about our subprocessors, contact us at: