Subprocessors
Pelcro Subprocessors
Pelcro wouldn't be possible without relying on third-party services. We have carefully reviewed and chosen our vendors to ensure they share our respect for your privacy and protection of your personal data. Individual data processing terms with those vendors are in place. The following third-party services transparency report gives you an overview of which external services we use, how and why:
Last updated: September 28, 2026
This page identifies our Subprocessors, where they process data, the services they provide to us, and the legal mechanism that protects each transfer of personal data. Our Subprocessors are all subject to written contract terms that require compliance with applicable data protection laws, including the European Union General Data Protection Regulation (GDPR) and the UK GDPR.
Where data is processed and how transfers are protected
Pelcro Inc. is a Canadian company. The European Commission recognizes Canada as providing an adequate level of protection for personal data (Decision 2002/2/EC), so personal data can flow from the EU to Pelcro without additional safeguards.
Our Subprocessors are based in the United States, and customer data is hosted on Amazon Web Services in the United States. For every transfer of EU personal data to a Subprocessor, we rely on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs (2021)"). Where a Subprocessor is certified under the EU-U.S. Data Privacy Framework (DPF), we also rely on that certification. For UK personal data, we rely on the UK International Data Transfer Addendum to the SCCs and, where certified, the UK Extension to the DPF. Each DPF certification listed below was verified on dataprivacyframework.gov on the date shown above.
| Service Provider | Data Categories | Business Purpose | Location | Transfer Safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Customer, End User | Cloud hosting, storage and AI processing (Amazon Bedrock) | United States (AI inference restricted to US regions) | EU-U.S. DPF (via Amazon.com, Inc.) + SCCs (2021) |
| HubSpot, Inc. | Customer, End User | CRM | United States | EU-U.S. DPF + SCCs (2021) |
| Stripe, LLC | Customer, End User | Payment processing | United States | EU-U.S. DPF + SCCs (2021) |
| Google LLC (Google Analytics) | End User | Web analytics | United States and other Google data centers | EU-U.S. DPF + SCCs (2021) |
| Cloudflare, Inc. | Customer, End User | Security and content delivery | United States and global edge network | EU-U.S. DPF + SCCs (2021) |
| Twilio Inc. | End User | Cloud communications | United States | EU-U.S. DPF + SCCs (2021) |
| Mixpanel, Inc. | End User | Product analytics | United States | EU-U.S. DPF + SCCs (2021) |
| The Rocket Science Group LLC (Mailchimp) | Customer | Email marketing | United States | EU-U.S. DPF (via Intuit Inc.) + SCCs (2021) |
| Docusign, Inc. | Customer | E-signature | United States | SCCs (2021) + Binding Corporate Rules |
| Slack Technologies, LLC | Customer | Communication and collaboration | United States | EU-U.S. DPF (via Salesforce, Inc.) + SCCs (2021) |
| Asana, Inc. | Customer | Project management | United States | EU-U.S. DPF + SCCs (2021) |
| Zendesk, Inc. | Customer | Customer support and ticketing | United States | EU-U.S. DPF + SCCs (2021) |
| Intercom, Inc. | Customer | Messaging and communications | United States | EU-U.S. DPF + SCCs (2021) |
| Functional Software, Inc. (Sentry) | Customer, End User | Application monitoring and error reporting | United States | EU-U.S. DPF + SCCs (2021) |
Changes to this list
Our business needs may change from time to time. For example, we may remove a Subprocessor to consolidate and minimize our use of Subprocessors, or add one if doing so will improve our ability to deliver our Services. We update this page whenever a Subprocessor is added or removed.
Before a new Subprocessor begins processing personal data on behalf of our customers, we give customers at least 30 days' notice. Customers may object to the new Subprocessor on reasonable data protection grounds within that 30-day period, as set out in Section 2.4 of our Data Processing Agreement. To receive these notices, email legal@pelcro.com with the subject line "Subscribe to Subprocessor updates".
Recent changes
- Sep-2022: Removed Fortrabbit - provider of cloud and hosting services from our sub-processors.
- Apr-2023: Added Functional Software, Inc (Sentry) - provider of cloud-based application performance monitoring & error tracking.
- Sep-2026: Updated the Amazon Web Services purpose to include AI processing through Amazon Bedrock, with inference restricted to US regions. Added a Transfer Safeguard column, listed each Subprocessor by its legal entity name, and corrected Stripe's entity name to Stripe, LLC.