Sub-processors
Last updated: August 13, 2026
Version: 1.5
Estudio Cactus Media S.L. ("Stowlog") uses the following sub-processors to provide the Stowlog platform. This list is maintained in accordance with Section 5 of our Data Processing Agreement, which requires us to notify Controllers at least thirty (30) days in advance of any intended change concerning additional sub-processors.
All transfers of personal data to sub-processors established outside the European Economic Area are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), automatically incorporated into the publicly available Data Processing Agreement of each sub-processor.
Current sub-processors
| Sub-processor | Role | Location | Transfer mechanism | Public DPA |
|---|---|---|---|---|
| AWS, Inc. | Cloud infrastructure (compute, object storage) | AWS Frankfurt (eu-central-1), EU | SCCs 2021 + EU-US DPF | View DPA |
| MongoDB Limited | Managed database hosting | EU (AWS Frankfurt) | SCCs 2021 Modules 2 & 3 + UK Addendum + DPF | View DPA |
| Twilio Inc. (SendGrid) | Transactional email delivery | US | SCCs 2021 + EU-US DPF | View DPA |
| Expo (650 Industries, Inc.) | Mobile push notification delivery | US | SCCs 2021 + GDPR-compliant DPA | View DPA |
| Google LLC | OAuth identity provider | US / EU | SCCs 2021 Modules 2 & 3 + EU-US DPF | View DPA |
| Microsoft Corporation | OAuth identity provider (Entra ID) | US / EU | SCCs 2021 (EU Model Clauses) + EU-US DPF | View DPA |
| Intercom, Inc. | Customer support messaging | US | SCCs 2021 + EU-US, UK, Swiss DPF | View DPA |
| New Relic, Inc. | Application observability | US | SCCs 2021 Modules 2 & 3 + UK Addendum + DPF | View DPA |
| PostHog, Inc. | Product analytics and usage instrumentation | EU data centre (customer-selected) / US | SCCs 2021 Module 2 + UK IDTA + EU-US DPF | View DPA |
| Vimeo, Inc. | Training video hosting and delivery | US | SCCs 2021 Modules 2 & 3 + UK Addendum | View DPA |
| Vercel Inc. | Frontend hosting and edge delivery; AI Gateway routing for AI-assisted features | US | SCCs 2021 Modules 1, 2 & 3 + UK IDTA | View DPA |
Sub-processor
AWS, Inc.
Role
Cloud infrastructure (compute, object storage)
Location
AWS Frankfurt (eu-central-1), EU
Transfer mechanism
SCCs 2021 + EU-US DPF
Public DPA
Sub-processor
MongoDB Limited
Role
Managed database hosting
Location
EU (AWS Frankfurt)
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum + DPF
Sub-processor
Twilio Inc. (SendGrid)
Role
Transactional email delivery
Location
US
Transfer mechanism
SCCs 2021 + EU-US DPF
Sub-processor
Expo (650 Industries, Inc.)
Role
Mobile push notification delivery
Location
US
Transfer mechanism
SCCs 2021 + GDPR-compliant DPA
Sub-processor
Google LLC
Role
OAuth identity provider
Location
US / EU
Transfer mechanism
SCCs 2021 Modules 2 & 3 + EU-US DPF
Sub-processor
Microsoft Corporation
Role
OAuth identity provider (Entra ID)
Location
US / EU
Transfer mechanism
SCCs 2021 (EU Model Clauses) + EU-US DPF
Sub-processor
Intercom, Inc.
Role
Customer support messaging
Location
US
Transfer mechanism
SCCs 2021 + EU-US, UK, Swiss DPF
Sub-processor
New Relic, Inc.
Role
Application observability
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum + DPF
Sub-processor
PostHog, Inc.
Role
Product analytics and usage instrumentation
Location
EU data centre (customer-selected) / US
Transfer mechanism
SCCs 2021 Module 2 + UK IDTA + EU-US DPF
Public DPA
Sub-processor
Vimeo, Inc.
Role
Training video hosting and delivery
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Sub-processor
Vercel Inc.
Role
Frontend hosting and edge delivery; AI Gateway routing for AI-assisted features
Location
US
Transfer mechanism
SCCs 2021 Modules 1, 2 & 3 + UK IDTA
Public DPA
Intended additions
The sub-processors below are not yet engaged. Each row states the date it was notified to Controllers and the date it takes effect, no fewer than thirty (30) days later. Controllers wishing to object on reasonable grounds may do so before the relevant effective date by writing to support@stowlog.com.
| Sub-processor | Role | Location | Transfer mechanism | Notified / effective | Public DPA |
|---|---|---|---|---|---|
| Twilio Inc. | SMS delivery for account security and identity verification | US | SCCs 2021 + EU-US DPF | 13 August 2026 → 12 September 2026 | View DPA |
| Google LLC (Gemini API) | AI processing for administration-panel assistance and, once released, identifier verification from user-supplied card images | US | SCCs 2021 Modules 2 & 3 + EU-US DPF | 13 August 2026 → 12 September 2026 | View DPA |
| OpenAI, L.L.C. | AI processing for document extraction when creating a facility, and fallback model for the remaining AI-assisted features | US | SCCs 2021 Modules 2 & 3 + UK Addendum | 13 August 2026 → 12 September 2026 | View DPA |
| X.AI LLC | Fallback AI processing where the primary model is unavailable, over the same requests the primary model receives | US | SCCs 2021 Modules 2 & 3 + UK Addendum | 13 August 2026 → 12 September 2026 | View DPA |
| Databricks, Inc. (Neon) | Managed Postgres for geoposition service asset management | EU (eu-central-1) | SCCs 2021 Modules 2 & 3 + UK IDTA (B1.0) | 13 August 2026 → 12 September 2026 | View DPA |
Sub-processor
Twilio Inc.
Role
SMS delivery for account security and identity verification
Location
US
Transfer mechanism
SCCs 2021 + EU-US DPF
Notified / effective
13 August 2026 → 12 September 2026
Sub-processor
Google LLC (Gemini API)
Role
AI processing for administration-panel assistance and, once released, identifier verification from user-supplied card images
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + EU-US DPF
Notified / effective
13 August 2026 → 12 September 2026
Sub-processor
OpenAI, L.L.C.
Role
AI processing for document extraction when creating a facility, and fallback model for the remaining AI-assisted features
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Notified / effective
13 August 2026 → 12 September 2026
Sub-processor
X.AI LLC
Role
Fallback AI processing where the primary model is unavailable, over the same requests the primary model receives
Location
US
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK Addendum
Notified / effective
13 August 2026 → 12 September 2026
Sub-processor
Databricks, Inc. (Neon)
Role
Managed Postgres for geoposition service asset management
Location
EU (eu-central-1)
Transfer mechanism
SCCs 2021 Modules 2 & 3 + UK IDTA (B1.0)
Notified / effective
13 August 2026 → 12 September 2026
Public DPA
Notification of changes
We will publish updates to this list on this page at least thirty (30) days before adding or replacing any sub-processor. Controllers may subscribe to changes by emailing support@stowlog.com.
Contact
For questions about our sub-processors or the transfer mechanisms applied, please contact support@stowlog.com.