Subprocessor Register
Last reviewed: 6 August 2026
CloudExpress uses the providers below where the relevant feature is enabled. Customer Files are intended to remain on CloudExpress-managed EU storage; other providers receive only the data needed for their stated purpose.
| Provider | Purpose | Data | Location / safeguard |
|---|---|---|---|
| Stripe | Payments, subscriptions, invoices, and fraud prevention | Account, billing, transaction, and limited technical data; CloudExpress does not store full card details | Locations disclosed by Stripe; GDPR transfer safeguards apply where required |
| Optional Google sign-in, reCAPTCHA security, and consented analytics or advertising measurement | OAuth profile data, IP/device and interaction data, depending on the feature | EEA and other disclosed locations; adequacy or Standard Contractual Clauses where required | |
| Microsoft | Optional Microsoft account sign-in | Basic OAuth profile and account identifiers | Locations disclosed by Microsoft; adequacy or Standard Contractual Clauses where required |
| CloudExpress-managed infrastructure | Application hosting, database, file storage, and encrypted backup | Customer Files, account data, transfer metadata, and operational records | Dublin, Ireland / European Union |
| Transactional email provider | Account and transfer notifications | Recipient address, message content, and delivery metadata | The configured provider is reviewed before production use; GDPR transfer safeguards apply where required |
Changes and objections
We update this register before adding a material subprocessor. Business customers may contact [email protected] to request notice of material changes or object on reasonable data-protection grounds under the DPA.