Subprocessors
What Is a Subprocessor?
A subprocessor is any third party that Verifox (verifox.ai) engages to process personal data on our behalf in connection with the delivery of our services. Under GDPR Article 28, we are required to enter into a Data Processing Agreement (DPA) with each subprocessor and to notify customers of any changes to the subprocessor list with reasonable prior notice.
We conduct due diligence on all subprocessors before engagement, including reviewing their security certifications, privacy policies, and DPAs. We require all subprocessors to implement appropriate technical and organisational measures to protect personal data.
Infrastructure and Hosting
| Vendor | Purpose | Data Location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Primary cloud infrastructure — compute, storage, databases | US-East-1, EU-West-1 | AWS DPA, SCCs |
| Cloudflare | CDN, DDoS protection, DNS | Global edge network | Cloudflare DPA, SCCs |
| Vercel | Frontend hosting and edge functions | US, EU | Vercel DPA, SCCs |
Payment Processing
| Vendor | Purpose | Data Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing | US, EU | Stripe DPA, SCCs, PCI-DSS Level 1 |
Verifox does not store full payment card data. All cardholder data is tokenised by Stripe at the point of entry. We receive only a payment token and the last 4 digits of the card.
Communications
| Vendor | Purpose | Data Location | Safeguard |
|---|---|---|---|
| Resend | Transactional email delivery (verification reports, alerts, invoices) | US | Resend DPA, SCCs |
| Intercom | Customer support chat and in-app messaging | US | Intercom DPA, SCCs |
| Mailchimp (Intuit) | Marketing email campaigns (only for opted-in users) | US | Mailchimp DPA, SCCs |
Analytics and Monitoring
| Vendor | Purpose | Data Location | Safeguard |
|---|---|---|---|
| PostHog | Product analytics (self-hosted) | EU (self-hosted on AWS EU-West-1) | No third-party transfer; controlled by Verifox |
| Sentry | Error monitoring and performance tracing | US | Sentry DPA, SCCs |
| Datadog | Infrastructure monitoring and log management | US | Datadog DPA, SCCs |
Data and Enrichment
| Vendor | Purpose | Data Location | Safeguard |
|---|---|---|---|
| Clearbit (HubSpot) | Company enrichment for Email Finder feature | US | Clearbit DPA, SCCs |
For the Email Finder feature, Verifox may use licensed B2B data from Clearbit to enrich company and professional information. This data covers business email addresses and professional contact information only — we do not use consumer data sources.
Changes to the Subprocessor List
We will provide at least 30 days' notice before adding a new subprocessor or making material changes to existing subprocessor arrangements. Notice will be provided by email to the account owner and by updating the "Last Updated" date on this page.
If you object to a new subprocessor, you may notify us at [email protected] within 30 days of the notice. If we cannot resolve your objection, you may terminate your subscription for cause and receive a pro-rated refund under our Refund Policy.
