Subprocessors
Version 3 · in force since 5 Oct 2026
Annex III — Subprocessors (as of 5 October 2026)
Hosted documents and the consent banner are not offered to new customers. References to generated documents, hosting, embeds and consent records describe existing customer use only.
- Subprocessor
- DigitalOcean, LLC
- Service
- Hosting of application and database
- Data
- All Customer Personal Data
- Location
- USA (New York, NYC3)
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Active
- Subprocessor
- Cloudflare, Inc.
- Service
- DNS, network and security; hosted-page and banner traffic for existing customers only
- Data
- Technical request data (IP address, user agent), content in transit
- Location
- Global network; company in USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Active
- Subprocessor
- Postmark (ActiveCampaign, LLC)
- Service
- Transactional email to Customer's users (not to visitors)
- Data
- Email addresses and message content of Customer's users
- Location
- USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Active
- Subprocessor
- Functional Software, Inc. (Sentry)
- Service
- Error monitoring, without request bodies, cookies or personal data except a user ID
- Data
- User ID, technical data
- Location
- USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Not active on 5 October 2026; 30 days' notice before activation
- Subprocessor
- OpenRouter, Inc.
- Service
- Vendor classifier: suggests a "Likely" vendor when a scan finds a vendor that our catalogue does not know. OpenRouter passes the request to the OpenAI model in the next row.
- Data
- Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data.
- Location
- USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Not active. No activation date is set; notice under section 7.2 is required before activation
- Subprocessor
- OpenAI, L.L.C.
- Service
- Vendor classifier: the AI model that OpenRouter calls (same purpose as the row above)
- Data
- Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data.
- Location
- USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Not active. No activation date is set; notice under section 7.2 is required before activation
- Subprocessor
- Cloudflare, Inc. (Workers AI)
- Service
- Vendor classifier, second model, used when the first one fails (same purpose as the rows above)
- Data
- Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data.
- Location
- Global network; company in USA
- Transfer safeguard
- Onward-transfer contract (SCCs Clause 8.8); DPF where certified
- Status
- Not active. No activation date is set; notice under section 7.2 is required before activation
| Subprocessor | Service | Data | Location | Transfer safeguard | Status |
|---|---|---|---|---|---|
| DigitalOcean, LLC | Hosting of application and database | All Customer Personal Data | USA (New York, NYC3) | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Active |
| Cloudflare, Inc. | DNS, network and security; hosted-page and banner traffic for existing customers only | Technical request data (IP address, user agent), content in transit | Global network; company in USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Active |
| Postmark (ActiveCampaign, LLC) | Transactional email to Customer's users (not to visitors) | Email addresses and message content of Customer's users | USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Active |
| Functional Software, Inc. (Sentry) | Error monitoring, without request bodies, cookies or personal data except a user ID | User ID, technical data | USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Not active on 5 October 2026; 30 days' notice before activation |
| OpenRouter, Inc. | Vendor classifier: suggests a "Likely" vendor when a scan finds a vendor that our catalogue does not know. OpenRouter passes the request to the OpenAI model in the next row. | Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data. | USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Not active. No activation date is set; notice under section 7.2 is required before activation |
| OpenAI, L.L.C. | Vendor classifier: the AI model that OpenRouter calls (same purpose as the row above) | Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data. | USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Not active. No activation date is set; notice under section 7.2 is required before activation |
| Cloudflare, Inc. (Workers AI) | Vendor classifier, second model, used when the first one fails (same purpose as the rows above) | Only vendor domains, cookie names and script hosts found in scans. No personal data is intended. Never page content, cookie values, form values, IP addresses or account data. | Global network; company in USA | Onward-transfer contract (SCCs Clause 8.8); DPF where certified | Not active. No activation date is set; notice under section 7.2 is required before activation |
The list of providers that do not process Customer Personal Data is new; Cloudflare Turnstile moves to that list.
Providers that do not process Customer Personal Data (listed for transparency; they are not Subprocessors under this DPA):
- Provider
- GitHub, Inc.
- Service
- Repository hosting that Customer chooses. When Customer connects a repository through the tosgenerator GitHub App, Sprout reads the repositories that Customer selects and, if Customer turns them on, posts checks or issues to them.
- Data
- Data in Customer's own GitHub account. Customer's agreement with GitHub governs it.
- Location
- USA
- Status
- Active when Customer connects a repository
- Provider
- Stripe
- Service
- Payments for Customer's own account, as a separate service
- Data
- Payment data of Customer's own account
- Location
- USA and other locations
- Status
- Active
- Provider
- Cloudflare, Inc. (Turnstile)
- Service
- Bot check on Sprout's own public scan form and policy check form
- Data
- IP address and browser and device signals of the person who uses the form, and the check result. Sprout is the controller of this data (Privacy Policy, /legal/privacy).
- Location
- Global network; company in USA
- Status
- Active
| Provider | Service | Data | Location | Status |
|---|---|---|---|---|
| GitHub, Inc. | Repository hosting that Customer chooses. When Customer connects a repository through the tosgenerator GitHub App, Sprout reads the repositories that Customer selects and, if Customer turns them on, posts checks or issues to them. | Data in Customer's own GitHub account. Customer's agreement with GitHub governs it. | USA | Active when Customer connects a repository |
| Stripe | Payments for Customer's own account, as a separate service | Payment data of Customer's own account | USA and other locations | Active |
| Cloudflare, Inc. (Turnstile) | Bot check on Sprout's own public scan form and policy check form | IP address and browser and device signals of the person who uses the form, and the check result. Sprout is the controller of this data (Privacy Policy, /legal/privacy). | Global network; company in USA | Active |
Sprout does not send Customer Personal Data to AI providers. The planned vendor classifier would send only the data in the OpenRouter, OpenAI and Cloudflare Workers AI rows, and Sprout turns it on only after the notice period in section 7.2.
Status on 5 October 2026: OpenRouter, OpenAI and Cloudflare Workers AI remain not active. No activation date is set. Any activation requires the notice in section 7.2, and Customer can object under section 7.3 by writing to facundomartin@sproutco.io.