Sub-processors
Last updated: September 12, 2026
Version: 1.6
Estudio Cactus Media S.L. ("Stowlog") uses the following sub-processors to provide the Stowlog platform. This list is maintained in accordance with Section 5 of our Data Processing Agreement, which requires us to notify Controllers at least thirty (30) days in advance of any intended change concerning additional sub-processors.
All transfers of personal data to sub-processors established outside the European Economic Area are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), automatically incorporated into the publicly available Data Processing Agreement of each sub-processor.
Current sub-processors
| Sub-processor | Role | Location | Transfer mechanism | Public DPA |
|---|---|---|---|---|
| AWS, Inc. | Cloud infrastructure (compute, object storage) | AWS Frankfurt (eu-central-1), EU | SCCs 2021 + EU-US DPF | View DPA |
| MongoDB Limited | Managed database hosting | EU (AWS Frankfurt) | SCCs 2021 Modules 2 & 3 + UK Addendum + DPF | View DPA |
| Twilio Inc. (SendGrid) | Transactional email delivery | US | SCCs 2021 + EU-US DPF | View DPA |
| Expo (650 Industries, Inc.) | Mobile push notification delivery | US | SCCs 2021 + GDPR-compliant DPA | View DPA |
| Google LLC | OAuth identity provider | US / EU | SCCs 2021 Modules 2 & 3 + EU-US DPF | View DPA |
| Microsoft Corporation | OAuth identity provider (Entra ID) | US / EU | SCCs 2021 (EU Model Clauses) + EU-US DPF | View DPA |
| Intercom, Inc. | Customer support messaging | US | SCCs 2021 + EU-US, UK, Swiss DPF | View DPA |
| New Relic, Inc. | Application observability | US | SCCs 2021 Modules 2 & 3 + UK Addendum + DPF | View DPA |
| PostHog, Inc. | Product analytics and usage instrumentation | EU data centre (customer-selected) / US | SCCs 2021 Module 2 + UK IDTA + EU-US DPF | View DPA |
| Vimeo, Inc. | Training video hosting and delivery | US | SCCs 2021 Modules 2 & 3 + UK Addendum | View DPA |
| Twilio Inc. | SMS delivery for account security and identity verification | US | SCCs 2021 + EU-US DPF | View DPA |
| Databricks, Inc. (Neon) | Managed Postgres for geoposition service asset management | EU (eu-central-1) | SCCs 2021 Modules 2 & 3 + UK IDTA (B1.0) | View DPA |
| Vercel Inc. | Frontend hosting and edge delivery; AI Gateway routing for AI-assisted features | US | SCCs 2021 Modules 1, 2 & 3 + UK IDTA | View DPA |
| Google LLC (Gemini API) | AI processing for administration-panel assistance and, once released, identifier verification from user-supplied card images | US | SCCs 2021 Modules 2 & 3 + EU-US DPF | View DPA |
| OpenAI, L.L.C. | AI processing for document extraction when creating a facility, and fallback model for the remaining AI-assisted features | US | SCCs 2021 Modules 2 & 3 + UK Addendum | View DPA |
| X.AI LLC | Fallback AI processing where the primary model is unavailable, over the same requests the primary model receives | US | SCCs 2021 Modules 2 & 3 + UK Addendum | View DPA |
Sub-processor
AWS, Inc.
Role
Cloud infrastructure (compute, object storage)
Location
AWS Frankfurt (eu-central-1), EU
Transfer mechanism
SCCs 2021 + EU-US DPF
Public DPA
Sub-processor
MongoDB Limited
Role
Managed database hosting
Location
EU (AWS Frankfurt)
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum + DPF
Sub-processor
Twilio Inc. (SendGrid)
Role
Transactional email delivery
Location
US
Transfer mechanism
SCCs 2021 + EU-US DPF
Sub-processor
Expo (650 Industries, Inc.)
Role
Mobile push notification delivery
Location
US
Transfer mechanism
SCCs 2021 + GDPR-compliant DPA
Sub-processor
Google LLC
Role
OAuth identity provider
Location
US / EU
Transfer mechanism
SCCs 2021 Modules 2 & 3 + EU-US DPF
Sub-processor
Microsoft Corporation
Role
OAuth identity provider (Entra ID)
Location
US / EU
Transfer mechanism
SCCs 2021 (EU Model Clauses) + EU-US DPF
Sub-processor
Intercom, Inc.
Role
Customer support messaging
Location
US
Transfer mechanism
SCCs 2021 + EU-US, UK, Swiss DPF
Sub-processor
New Relic, Inc.
Role
Application observability
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum + DPF
Sub-processor
PostHog, Inc.
Role
Product analytics and usage instrumentation
Location
EU data centre (customer-selected) / US
Transfer mechanism
SCCs 2021 Module 2 + UK IDTA + EU-US DPF
Public DPA
Sub-processor
Vimeo, Inc.
Role
Training video hosting and delivery
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Sub-processor
Twilio Inc.
Role
SMS delivery for account security and identity verification
Location
US
Transfer mechanism
SCCs 2021 + EU-US DPF
Sub-processor
Databricks, Inc. (Neon)
Role
Managed Postgres for geoposition service asset management
Location
EU (eu-central-1)
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK IDTA (B1.0)
Public DPA
Sub-processor
Vercel Inc.
Role
Frontend hosting and edge delivery; AI Gateway routing for AI-assisted features
Location
US
Transfer mechanism
SCCs 2021 Modules 1, 2 & 3 + UK IDTA
Public DPA
Sub-processor
Google LLC (Gemini API)
Role
AI processing for administration-panel assistance and, once released, identifier verification from user-supplied card images
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + EU-US DPF
Sub-processor
OpenAI, L.L.C.
Role
AI processing for document extraction when creating a facility, and fallback model for the remaining AI-assisted features
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Sub-processor
X.AI LLC
Role
Fallback AI processing where the primary model is unavailable, over the same requests the primary model receives
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Notification of changes
We will publish updates to this list on this page at least thirty (30) days before adding or replacing any sub-processor. Controllers may subscribe to changes by emailing [email protected].
Contact
For questions about our sub-processors or the transfer mechanisms applied, please contact [email protected].