Sub-processors
Last updated: 2 May 2026
Stack Seven AS engages a limited number of sub-processors to deliver Policy Confirm. This page lists each sub-processor, the services provided, the location of processing, applicable transfer mechanisms, and the role of each party.
This list forms part of our Data Processing Agreement and is referenced in our Privacy Policy.
Current sub-processors
Google Cloud EMEA Limited
- Role
- Sub-processor
- Service
- Application hosting, database, file storage, and serverless infrastructure.
- Categories of personal data
- Customer account data, recipient data, policy metadata, confirmation records, system logs.
- Location
- EU
- International transfers
- Personal data may be accessed from outside the EU in connection with operational support, subject to appropriate safeguards.
- Transfer mechanism
- EU Standard Contractual Clauses, EU-US Data Privacy Framework, UK Extension to the EU-US DPF
- Documentation
- cloud.google.com/terms/data-processing-addendum
Stripe Payments Europe Limited
- Role
- Independent controller
- Service
- Payment processing, billing, and subscription management.
- Categories of personal data
- Billing information, payment details, transaction data, limited customer account data.
- Location
- EU
- International transfers
- Stripe may transfer personal data outside the EEA in accordance with its own obligations as a controller.
- Transfer mechanism
- As determined by Stripe in its role as independent controller
- Documentation
- stripe.com/privacy
Microsoft Ireland Operations Limited
- Role
- Sub-processor
- Service
- Business email used for customer correspondence and support.
- Categories of personal data
- Customer contact data, communication content, support-related information.
- Location
- EU
- International transfers
- Personal data may be accessed from outside the EU in connection with operational support, subject to appropriate safeguards.
- Transfer mechanism
- EU Standard Contractual Clauses, Microsoft EU Data Boundary commitments where applicable
Astrodon Corporation
- Role
- Sub-processor
- Service
- Transactional and marketing email delivery.
- Categories of personal data
- Recipient name and email address. No policy content, names, version numbers, or confirmation details are transmitted via this service.
- Location
- US
- International transfers
- Personal data is processed in the United States.
- Transfer mechanism
- EU-US Data Privacy Framework, UK Extension to the EU-US DPF, EU Standard Contractual Clauses
- Documentation
- loops.so/dpaloops.so/privacy
How sub-processors are selected
Sub-processors are engaged where necessary to deliver Policy Confirm. Each is assessed for security posture, data protection commitments, and ability to support international transfer requirements before engagement.
International transfers
Where personal data is transferred outside the EEA or the UK to a country without an adequacy decision, appropriate safeguards are in place.
These include:
- EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)
- EU-US Data Privacy Framework, where applicable
- UK Extension to the EU-US Data Privacy Framework, where applicable
- Other lawful transfer mechanisms recognized under applicable data protection law
Notification of changes
Stack Seven AS will provide at least thirty (30) days' prior written notice before adding or replacing a sub-processor.
Customers may object on reasonable data protection grounds. If no reasonable alternative can be provided, the customer may terminate the affected service in accordance with the Data Processing Agreement.