LegalVersion 2026-04-24
Sub-processors
These are the third parties we engage to deliver the platform. Each one is bound by a data processing agreement and processes your data only on our documented instructions.
We give 30 days' notice before adding a sub-processor or replacing an existing one, so you have time to object. Notice goes out by email and through the portal banner on the day the change is published here.
| Sub-processor | Role | What it processes | Location | Transfers |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Primary cloud infrastructure | RDS (PostgreSQL primary database), S3 (object storage for telemetry), EC2/EKS (compute), CloudWatch (operational logs), VPC and IAM (network and access control).account data · billing data · telemetry data · audit data · consent data | Ireland (eu-west-1) primary; per-tenant regions for telemetry storage, for example ap-south-1. | SCCs incorporated into AWS GDPR DPA |
| AWS Cognito | Identity provider | OIDC sign-in for portal users. xScaler does not store passwords for SSO users; Cognito holds password hashes for any users on the local-credentials path created via Cognito.account data | per Cognito user pool region. | SCCs (AWS GDPR DPA) |
| Stripe Payments Europe, Ltd. | Billing and payment processing | Subscription management, invoice generation, payment-method storage, tax handling.billing data · account data | EU + US | SCCs incorporated into Stripe DPA |
| Zoho Corporation B.V. | Customer support ticketing | Inbound and outbound support communication, ticket history, attachments uploaded by customers.support data · account data | per Zoho EU data center (configurable) | SCCs incorporated into Zoho DPA |
| Amazon SES | Transactional email delivery | Outbound delivery of account-related email: invitations, email change verifications, alert notifications.account data · support data | per SES region; documented per env in the operator runbook. | SCCs incorporated into AWS GDPR DPA |