Sub-processors
Last updated: 22 October 2026
Stack Seven AS engages a limited number of sub-processors to deliver Policy Confirm. This page lists each sub-processor, the services provided, the location of processing, applicable transfer mechanisms, and the role of each party.
This list forms part of our Data Processing Agreement and is referenced in our Privacy Policy.
Current sub-processors
Google Cloud EMEA Limited
- Role
- Sub-processor
- Service
- Application hosting, database, file storage, and serverless infrastructure.
- Categories of personal data
- Customer account data, recipient data, policy metadata, confirmation records, system logs.
- Location
- EU or US, depending on the region the customer's organization is set up in. The two regions are separate environments, and data is not replicated between them.
- International transfers
- Personal data may be accessed from outside the EU in connection with operational support, subject to appropriate safeguards.
- Transfer mechanism
- EU Standard Contractual Clauses, EU-US Data Privacy Framework, UK Extension to the EU-US DPF
- Documentation
- cloud.google.com/terms/data-processing-addendum
Google Cloud EMEA Limited (Vertex AI and Document AI)
- Role
- Sub-processor
- Service
- AI services behind Policy Intelligence, an optional add-on: reading text from policy documents (Document AI, including OCR of scanned pages), search embeddings, and answers to questions about the customer's policies (Anthropic's Claude models, provided by Google as a Vertex AI partner model). Used only for organizations that have turned Policy Intelligence on, and only for the policies the customer has chosen.
- Categories of personal data
- Text of the chosen policy documents, including any personal data they contain, questions asked by administrators and, where the customer allows it, by recipients in the policy portal, and the answers given.
- Location
- EU or US, the same region as the customer's organization. Requests go to Vertex AI's EU or US multi-region endpoint and Document AI's EU or US location.
- International transfers
- None beyond those described for Google Cloud EMEA Limited above. Content is not used to train AI models.
- Transfer mechanism
- EU Standard Contractual Clauses, EU-US Data Privacy Framework, UK Extension to the EU-US DPF
Stripe Payments Europe Limited
- Role
- Independent controller
- Service
- Payment processing, billing, and subscription management.
- Categories of personal data
- Billing information, payment details, transaction data, limited customer account data.
- Location
- EU
- International transfers
- Stripe may transfer personal data outside the EEA in accordance with its own obligations as a controller.
- Transfer mechanism
- As determined by Stripe in its role as independent controller
- Documentation
- stripe.com/privacy
Microsoft Ireland Operations Limited
- Role
- Sub-processor
- Service
- Business email, Microsoft Teams and file storage, used for customer correspondence, support and internal collaboration.
- Categories of personal data
- Customer contact data, communication content, support-related information, and documents a customer shares with us.
- Location
- EU
- International transfers
- Personal data may be accessed from outside the EU in connection with operational support, subject to appropriate safeguards.
- Transfer mechanism
- EU Standard Contractual Clauses, Microsoft EU Data Boundary commitments where applicable
Astrodon Corporation
- Role
- Sub-processor
- Service
- Transactional and marketing email delivery.
- Categories of personal data
- Recipient name and email address. No policy content, names, version numbers, or confirmation details are transmitted via this service.
- Location
- US
- International transfers
- Personal data is processed in the United States.
- Transfer mechanism
- EU-US Data Privacy Framework, UK Extension to the EU-US DPF, EU Standard Contractual Clauses
- Documentation
- loops.so/dpaloops.so/privacy
How sub-processors are selected
Sub-processors are engaged where necessary to deliver Policy Confirm. Each is assessed for security posture, data protection commitments, and ability to support international transfer requirements before engagement.
International transfers
Where personal data is transferred outside the EEA or the UK to a country without an adequacy decision, appropriate safeguards are in place.
These include:
- EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)
- EU-US Data Privacy Framework, where applicable
- UK Extension to the EU-US Data Privacy Framework, where applicable
- Other lawful transfer mechanisms recognized under applicable data protection law
Notification of changes
Stack Seven AS will provide at least thirty (30) days' prior written notice before adding or replacing a sub-processor.
Customers may object on reasonable data protection grounds. If no reasonable alternative can be provided, the customer may terminate the affected service in accordance with the Data Processing Agreement.