RegulatoryBridge engages the third-party sub-processors below to provide the Services. When we provide processor services to a customer, each sub-processor processes personal data on the customer's behalf and is bound by written terms providing protection at least as protective as our DPA. The customer's contracting entity and Data Processing Addendum determine the precise sub-processor scope.
Current sub-processors
| Sub-processor | Service | Purpose | Location | Transfer mechanism | Category |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | AWS (EC2, S3, RDS, KMS) | Primary cloud hosting and storage for customer-facing services. | EU (Ireland) primary, with US fallback | EU SCCs (Module 2) | Infrastructure |
| Vercel Inc. | Vercel | Edge runtime, image optimisation, deployment platform for marketing surface. | Global edge network (CDN) | EU SCCs + DPA | Infrastructure |
| Cloudflare, Inc. | Cloudflare (CDN, WAF, Bot Management, DNS) | DDoS protection, WAF, request routing, DNS, bot management. | Global edge network | EU SCCs + DPA | Infrastructure |
| Google LLC | Workspace (Gmail, Drive, Meet) | Internal email, document collaboration, video meetings. | EU + US | EU-US DPF + EU SCCs | Communications |
| Resend, Inc. | Resend | Transactional email delivery (account, billing, breach notifications). | US, EU region available | EU SCCs + DPA | Communications |
| Mailchimp / Intuit Inc. | Mailchimp | Marketing email (newsletters, regulatory updates) - only with consent. | US | EU SCCs + DPF | Communications |
| Twilio Inc. | Twilio (SMS, voice) | Emergency-response SMS, voice notifications for breach workflow. | Global, EU region for EU traffic | EU SCCs + DPA | Communications |
| Plausible Insights OÜ | Plausible Analytics | Privacy-friendly website analytics - only with consent. | EU (Estonia) | Within EEA - no transfer | Analytics |
| Google LLC | Google Analytics 4 | Supplementary funnel analytics - only with consent. IP truncation enabled. | US + EU | EU-US DPF + EU SCCs | Analytics |
| Sentry, Inc. | Sentry | Application error monitoring, performance traces. | EU region (Frankfurt) by default | EU SCCs | Analytics |
| HubSpot, Inc. | HubSpot CRM + Marketing Hub | Sales pipeline, contact records, marketing automation. | US + EU | EU SCCs + DPF | CRM/Sales |
| Slack Technologies LLC | Slack | Internal team communication, customer Slack-Connect channels. | US, EU data residency available | EU SCCs | Communications |
| Stripe, Inc. / Stripe Payments Europe Ltd | Stripe | PCI-DSS-compliant payment processing for subscription billing. | EU (Ireland) for EU customers, US for others | EU SCCs | Payments |
| Linear Orbit Inc. | Linear | Internal task tracking for engineering and customer support. | US | EU SCCs + DPA | Support |
| Notion Labs, Inc. | Notion | Internal knowledge base, runbooks, customer-facing onboarding handbooks. | US | EU SCCs | Support |
Change notifications
Before engaging a new sub-processor that will process customer personal data, we will provide at least 30 days' prior notice via email (to the contact of record on your account) and by updating this page. You may object to a new sub-processor on reasonable grounds within that window, and we will work in good faith to find a solution or, if none is workable, allow you to terminate the affected service.
Questions
See the Data Processing Addendum for the contractual terms governing sub-processor engagements. For specific questions email dpo@regulatorybridge.com.
Frequently Asked Questions
What is a sub-processor?+
A third party we engage to process personal data on your behalf while delivering the Services — for example hosting, email delivery or support tooling. Each one is bound by data protection terms consistent with our Data Processing Addendum.
Which sub-processors does RegulatoryBridge engage?+
The table above lists the current sub-processors with their purpose and processing location, covering categories such as infrastructure and hosting, email delivery, productivity tooling and analytics.
Will I be notified before a new sub-processor is added?+
Yes. Before engaging a new sub-processor that will process customer personal data we provide advance notice, so you have time to review the change. You can subscribe to change notifications using the link at the top of the page.
Can I object to a new sub-processor?+
The objection process is set out in the Data Processing Addendum, which governs sub-processor authorisation, the notice period and what happens if you raise a reasoned objection on data protection grounds.
Where are the contractual terms that apply to sub-processors?+
In the Data Processing Addendum — section 7 covers sub-processor authorisation and our responsibility for their performance, and Annex C refers to this list.
How current is this list?+
The "Last updated" date at the top of the page shows when it was last reviewed. Read it together with the notice at the foot of the page, which explains the status of the entries, and contact us if you need the position confirmed for a specific engagement.
Ready to Achieve Global Regulatory Compliance?
Partner with RegulatoryBridge for comprehensive compliance representation across global jurisdictions.
