The third parties we use to operate the Service. Region-pinned where the data plane requires it. Notification 30 days before changes.
Sub-processors are third parties we use to provide the Service. The list below is current as of the effective date at the top of this page. We provide at least 30 days' notice before adding or replacing a sub-processor, by email to the account's primary contact and by publishing an updated list here. Subscribe to changes via subprocessor-updates@clusterbid.eu.
The live sub-processor roster is temporarily unavailable. Email legal@clusterbid.eu for the current list.
Each sub-processor is selected against a baseline of: written DPA on terms equivalent to or stronger than ours; demonstrated security posture (SOC 2 Type II, ISO 27001, or equivalent third-party attestation); region-resident data handling for any sub-processor in the data plane; and a track record we are comfortable defending to a regulated buyer's procurement team.
Controllers may object to a new sub-processor on reasonable data-protection grounds within 30 days of notice. Email legal@clusterbid.eu. If the objection cannot be resolved, Controller may terminate the affected portion of the Service with a pro-rata refund for the unused term.