Who else touches your data, and where it sits.
Two registers, read live. A data protection officer needs both before they can complete an assessment, and both include the entries that reflect badly on us — an unexecuted agreement and an unverified region are exactly the facts an assessment exists to surface.
Subprocessors
Each of these processes customer data on our behalf for the stated purpose. The agreement column is the one to read carefully.
Stated precisely
- No executed data processing agreement has been recorded with any subprocessor. The register shows this rather than hiding it, and we do not imply an agreement exists.
- Every entity above is registered in the United States. Where that is a problem for your jurisdiction, it is a scoping conversation before contract rather than a discovery after it.
Processing locations
Per component and provider, with the verification state of each. A region becomes a claim only once it is verified.
How this changes
This page reads the register directly, so it changes when the register does — when an agreement is executed, when a region is verified, or when a subprocessor is added or retired. There is no separately maintained copy of this list that could fall behind it.