| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Primary cloud hosting (compute, storage, KMS). | All Customer Content. | Frankfurt (eu-central-1), Paris (eu-west-3) |
| Google Cloud Platform | Disaster-recovery hosting and managed BigQuery analytics. | Customer Content (encrypted backups), aggregated analytics. | Frankfurt (europe-west3) |
| Stripe, Inc. | Subscription billing and payment processing. | Billing contact, invoicing address, card data (PCI-scoped). | United States, with EU Standard Contractual Clauses. |
| Anthropic PBC | AI reply drafting, sentiment classification. | Review text and brand-voice settings, sent per-request under zero-data-retention agreement. | United States, with EU SCCs and DPF certification. |
| OpenAI, LLC | Backup AI provider for reply drafting (failover only). | Review text and brand-voice settings, sent per-request under zero-data-retention agreement. | United States, with EU SCCs. |
| Postmark (ActiveCampaign) | Transactional email delivery. | Account email, transactional content. | United States and EU edge points. |
| Twilio Inc. | SMS delivery for review requests and alerts. | Phone numbers, message text. | Ireland (EU region). |
| Plausible Analytics | Privacy-friendly product analytics (cookie-less). | Aggregated, anonymized usage events. | Germany. |
| Intercom Inc. | Customer support and in-app messaging. | Account email, role, support conversation transcripts. | Ireland; United States with EU SCCs. |
| HubSpot Inc. | Sales CRM and marketing email. | Prospect contact data, sales conversation history. | Germany. |
| Cloudflare Inc. | CDN, DDoS protection and WAF. | IP addresses, request metadata. | Global anycast edge. |
Change-notification commitment
Reputafy commits to give Customers at least 30 days' advance written notice of any new subprocessor. Customers may object in writing for legitimate data-protection reasons under the Data Processing Addendum.