Vendor relies on the third parties listed below to operate the platform. Each is bound by a Data Processing Agreement with confidentiality, security, and breach-notification obligations equivalent to or stricter than ours. We notify customers at least 30 days before adding a new sub-processor.
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — compute, database, object storage, transactional email (SES), message queues, authentication (Cognito), search (OpenSearch), hosting (Amplify) | All platform data | EU (Frankfurt) + US (N. Virginia, failover) |
| Cloudflare | CDN, DNS, DDoS protection | Request metadata, IP addresses, page caches | Global edge |
| Stripe | Payment processing | Cardholder data, billing addresses, transaction history | US, EU |
| PayPal | Payment processing (alternative) | PayPal account email, transaction history | US, EU |
| Casys (CPay) | Card payment processing | Cardholder data, billing details, transaction references | North Macedonia |
| Halkbank (NestPay) | Card payment processing | Cardholder data, transaction details | North Macedonia |
| NLB / Bankart | Card payment processing | Cardholder data, transaction details | Slovenia (EU) |
| Payrexx | Payment processing (hosted gateway) | Customer billing details, transaction data | Switzerland |
| Iute | Buy Now, Pay Later payment processing | Customer billing details, order and transaction data | EU |
| Maps & geocoding, web fonts, reCAPTCHA bot protection | Location data, IP addresses, bot-detection signals | Global (US, EU) | |
| Mapbox | Maps & geocoding | Location data, IP addresses | US, EU |
| flagcdn.com | Country flag image delivery | Request IP addresses only — static images, no account data | Global edge |
| Microtica | Deployment & CI/CD platform | Build artifacts, deployment configuration — no customer data | EU |
| GitLab | Source-code management & private package registry | Source code only — no customer data | US (GitLab.com) |