Sub Processors
| Sub Processor | Purpose | Processing location | Categories of personal data | Transfer mechanism |
|---|---|---|---|---|
| DigitalOcean | Cloud infrastructure hosting | Singapore region (primary); US region (failover) | All Platform Personal Data at rest and in transit | GDPR SCCs Module 2 (where applicable); DPA in place |
| Amazon Web Services | Cloud infrastructure (specified workloads) | Singapore region (primary) | Platform Personal Data for named workloads | GDPR SCCs Module 2; BAA/DPA in place |
| Stripe | Payment processing (card acquiring) | US and EEA | Tokenised payment data; billing contact data | Stripe DPA; SCCs where applicable |
| 2C2P | Payment processing (SE Asia rails) | Singapore | Tokenised payment data; billing contact data | 2C2P DPA |
| GoDaddy | Corporate website hosting and DNS | US | Marketing intake data (contact form); no PHI | GoDaddy DPA (scoped to marketing data) |