Legal

Sub-processors.

Effective2026-05-11

Versionv0.1 (draft)

Jurisdiction[PLACEHOLDER: Delaware, USA]

1. Overview

ObservOne engages a small number of third-party service providers ("sub-processors") to help us deliver the Service. Each sub-processor is bound by data protection terms consistent with the obligations in our Data Processing Addendum and our privacy notice.

This page lists the sub-processors currently engaged. We update it whenever we add, remove or materially change a sub-processor relationship, and we notify customers as described in § 3.

The roster below is illustrative pending counsel and procurement review. Final names, purposes and processing locations will be confirmed against our actual vendor contracts before this page is removed from draft status.

2. Current sub-processors

Sub-processor	Purpose	Data categories	Processing location
[PLACEHOLDER: Amazon Web Services, Inc.]	Cloud infrastructure (compute, storage, database)	All Customer Data	US, EU, AP — per tenant region pinning
[PLACEHOLDER: Cloudflare, Inc.]	CDN, WAF, DDoS protection, DNS	Network metadata, IP addresses	Global edge network
[PLACEHOLDER: Vercel Inc.]	Marketing site + auxiliary frontend hosting	Visitor logs, contact form submissions	US, EU
[PLACEHOLDER: Datadog, Inc.]	Application performance + infrastructure monitoring	Telemetry, logs (PII scrubbed), traces	US, EU
[PLACEHOLDER: Resend / Postmark / SendGrid]	Transactional email delivery	Recipient email, message content	US
[PLACEHOLDER: Stripe, Inc.]	Payments processing (if applicable to tier)	Billing contact, payment instrument	US
[PLACEHOLDER: Linear / Jira / Notion]	Internal issue tracking, customer support tickets	Customer contact, support ticket content	US
[PLACEHOLDER: Slack Technologies, LLC]	Customer communication via Slack Connect	Customer contact, message content	US
[PLACEHOLDER: HubSpot / Salesforce]	CRM, marketing communications	Business contact, marketing preferences	US
[PLACEHOLDER: Posthog / Mixpanel / Amplitude]	Product analytics (consented)	Anonymised usage metadata	US, EU

Customer Data is pinned to its region of origin by default. Multi-region replication is opt-in per tenant.

3. Onboarding & change notification

Before a new sub-processor is engaged for the processing of Customer Data, we will:

Conduct due diligence against our vendor security and privacy criteria
Enter into a written data protection agreement consistent with our customer commitments
Update this page with the new sub-processor and its details
Notify customer account administrators by email at least [PLACEHOLDER: 30 days] before the new sub-processor begins processing Customer Data

Customers who subscribe to change notifications via their account settings receive the same notice automatically. The same process applies to material changes in purpose, data categories or processing location for an existing sub-processor.

4. Customer objection rights

A customer may object to a new or changed sub-processor on reasonable grounds related to data protection within [PLACEHOLDER: 30 days] of notification. We will work in good faith to accommodate the objection, including by proposing a commercially reasonable alternative.

If no reasonable accommodation is possible, the customer may terminate the affected portion of the Service for cause and receive a pro-rated refund of any pre-paid fees, as further described in our terms of service and Data Processing Addendum.

5. Contact

Privacy team — privacy@observone.com

To subscribe to sub-processor change notifications, contact the privacy team or enable the option in your tenant settings.

Platform

Solutions

Company