Cloud

Sub-processors

Version 2026-10-11, effective 2026-10-11

Draft for review. This document is not yet in effect.

About this list

This document lists Dvelopin's sub-processors and other recipients for the Dvelopin client portal and the hosting it manages for customers.

For the websites, servers and content Dvelopin hosts for its customers, Dvelopin is the customer's processor, and the vendors below that handle that data are its sub-processors. For portal accounts, sign-in, security logs, billing and text messages, Dvelopin is the controller; the vendors that handle that data are listed too, so this page names every vendor that receives personal data from the portal. [to be confirmed]

Dvelopin is not certified under the EU-US Data Privacy Framework and does not represent that it is. The "DPF" entries below describe each vendor's own status on the DPF list, not Dvelopin's.

Sub-processors in use today

  • AWS (Lightsail, S3, SES, SNS): hosting, server management, file storage, backups, email. The websites, servers and backups Dvelopin hosts for customers, and all personal data the portal holds, as listed in our privacy notice. United States (us-east-2) for the portal server, email, backups and text-message attachments; the region of customer servers and of tax-exemption documents is [to be confirmed]. EU option: Lightsail in Frankfurt, Ireland, London, Paris, Stockholm (Spain opt-in); SES in several EU regions. [to be confirmed]. Processor. SCC Modules 2 and 3, UK Addendum, DPF (active, under Amazon.com, Inc.)
  • Stripe: payment processing on the billing page. Billing contact email and organization name, Stripe customer IDs, saved payment method details (card brand, last four digits, expiry, wallet type), and a payment request per invoice (amount and invoice number). This is Dvelopin's controller data; Stripe is listed here so this page names every vendor that receives personal data from the portal. [to be confirmed]. No EU region offered; data "may be stored and processed in any country where we do business". Processor; independent controller for fraud, AML, KYC, and analytics. DPF first, then SCC Modules 1 to 3, UK Addendum (active, Stripe, LLC)
  • Telnyx: SMS and MMS for Dvelopin's staff text inbox on its own business phone numbers. Phone numbers, message text and attachments of messages to and from those numbers, and delivery reports; the vendor's own message logs. This is Dvelopin's controller data. [to be confirmed]. EU option: partial, an at-rest locality option in Germany. Processor for content; independent controller for account and usage data, including message logs. SCC Modules 1 to 3, UK Addendum, DPF (active)
  • Google (Google Workspace): business email. Email sent to or from any @dvelopin.com address, including privacy@dvelopin.com, with its attachments. This is Dvelopin's controller data. Location: any country where Google or its sub-processors have facilities; no data region is set [to be confirmed]. EU option: Google data regions (United States or Europe) on Business Standard, Business Plus and some Enterprise editions. Processor. DPF (active, Google LLC: EU-US, Swiss-US and the UK Extension) first, then SCCs

AWS data processing addendum

Stripe data processing addendum

Telnyx data processing addendum

Google Cloud data processing addendum

Not used today

The following vendor is not engaged. It is not a sub-processor today and is not authorized by the current DPA. It would be added only through the notice and objection process below.

  • Twilio: an alternative SMS provider. The portal's code includes it, but it is not switched on, so no data goes to Twilio. Not engaged.

Twilio data protection addendum

Other recipients (not sub-processors)

These recipients are not Dvelopin's sub-processors. Where one acts as an independent controller, Dvelopin's privacy notice names it as a recipient.

  • Google Pay (inside Stripe's Express Checkout): wallet payment option on the billing page, only if the user chooses it. Independent controller under its own API terms (dated 2021, still citing Privacy Shield). No DPA with Dvelopin.
  • Apple Pay (inside Stripe's Express Checkout): wallet payment option on the billing page, only if the user chooses it. [to be confirmed]. No DPA with Dvelopin.
  • Let's Encrypt: issues the TLS certificate for the portal's web address. Acts for its own purposes. It receives Dvelopin's certificate account details and server information, not users' personal data. No DPA with Dvelopin.

Change notice and objection

When Dvelopin intends to add or replace a sub-processor:

  • Written notice: Dvelopin gives the customer written notice at least 30 days before the change takes effect. The notice identifies the new or replacement sub-processor, its role, its location, and the transfer tool that will apply.
  • Automatic notices and public page: a public sub-processor page (this page) and automatic notices to organization owners, each with an effective date 30 days out, are available [planned: G6].
  • Right to object: the customer may object to a proposed change on reasonable grounds relating to data protection within the 30-day notice period. If the parties cannot resolve the objection: [to be confirmed].
Sign in