Subprocessor List
Last Updated: October 2026
The following subprocessors are engaged by PartnerAPI to process personal data on behalf of our customers. Each is engaged under a written data processing agreement, except where the Transfer Mechanism column below states that the agreement is still under review.
<!-- SUBPROCESSORS:START (auto-generated from docs/gdpr/subprocessors.yaml — run pnpm subprocessors:generate after editing the YAML) -->
Infrastructure & Hosting
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| AWS (S3, SES) | Object storage, email delivery | EU (eu-west-1, eu-north-1) | N/A (EU) |
| Render | Managed application hosting and managed database — runs the PartnerAPI API and its background workers, and hosts the primary application database. Render operates on AWS infrastructure. | EU (Frankfurt) — application services, background workers and managed Postgres | EU-US DPF + SCCs + DPA |
| Vercel | Frontend application hosting — serves the public tenant landing pages and the authenticated partner portal, including sign-in and server-side rendering of portal pages. Personal data passes through Vercel in transit and in server-render memory; the web tier holds no database of its own. Vercel operates on third-party cloud infrastructure. | US (Vercel Inc.) — no deployment region pinned in our configuration | SCCs + DPA |
| Vercel (Sandbox) | Isolated, single-use compute for automated dependency upgrades — when a customer enables upgrade runs, a copy of the connected code repository (including commit author names and email addresses in its history) is built and updated inside a temporary virtual machine with restricted network access. Not yet in use; listed in advance. | EU (Frankfurt) | SCCs + DPA |
Monitoring & Observability
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Sentry | Error tracking and monitoring | EU (Frankfurt) | N/A (EU) |
| Grafana Cloud (Loki) | Platform service-log storage and querying — PartnerAPI's own observability only. Customer API logs are not stored here; they live in PartnerAPI's own log infrastructure in AWS eu-north-1. | EU | SCCs |
AI & Machine Learning
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| OpenAI | AI embedding generation, inference, and content moderation for partner-uploaded knowledge documents | US | SCCs + DPA |
| Chroma Inc. (Chroma Cloud) | Vector embedding storage for tenant document content (per-tenant collections used for AI knowledge retrieval) | EU (Belgium) | SCCs + DPA (DPA under review) |
| Vercel (v0) | Generative AI for tenant landing pages — when a tenant admin asks for a landing page to be generated or changed, the prompt, any reference-page content and the page's current HTML are sent to Vercel v0 to produce the new page. Personal data reaches it only where the tenant's own prompt or page copy contains it. | US (Vercel Inc.) | SCCs (pending acceptance) (DPA under review) |
Communications
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Slack | Notification delivery to your own Slack workspace, and the Slack interface to the assistant. Notification content, assistant conversations held in Slack, and the Slack account identifier used to route them are processed by Slack. | US | SCCs + EU-US DPF + DPA |
| Zoom (Zoom Scheduler) | Meeting booking for the final step of the partnership-map claim flow — the email address of someone claiming a company profile is passed to Zoom's scheduler so the booking form arrives prefilled, and Zoom records the booking details. | US | SCCs + EU-US DPF + DPA |
| Mailjet | Transactional email delivery | EU (France) | N/A (EU) |
Billing & Payments
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Stripe | Payment processing and billing | US/EU | SCCs + DPA |
Identity & Integrations
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Atlassian (Confluence + OAuth) | OAuth identity provider; Confluence page content ingestion when the Controller enables the Confluence integration | US | SCCs + DPA |
<!-- SUBPROCESSORS:END -->
Changes to This List
We will notify customers of any changes to our subprocessor list at least 30 days before a new subprocessor begins processing personal data. Customers may object to the appointment of a new subprocessor as outlined in our Data Processing Agreement.
For questions about our subprocessors, contact us at: