1. Overview
SignalGate uses a small set of third-party service providers ("subprocessors") to deliver the Service. Each subprocessor is bound by a written contract that imposes data-protection obligations at least as protective as those in our Data Processing Addendum. SignalGate remains liable to Customer for the performance of every subprocessor.
The tables below list each subprocessor, the service it provides, the categories of Customer Data it processes, where the processing happens, and the transfer mechanism relied on for any cross-border flow.
2. Infrastructure
| Subprocessor | Service | Data category | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Compute, storage, networking (ECS, S3, RDS, CloudWatch) for the production environment. | All Customer Data — encrypted fingerprint payloads, account data, logs. | EU — Frankfurt (eu-central-1). | SCCs Module 2; Schrems II supplementary measures; AWS Data Processing Addendum signed. |
3. Communications
| Subprocessor | Service | Data category | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Transactional email provider | Outbound transactional email (signup confirmation, password reset, alerts). | Recipient email address, name, and the email body. | EU / EEA, or a jurisdiction covered by an adequacy decision or SCCs. | Standard Contractual Clauses and the provider's Data Processing Agreement. |
4. Billing
| Subprocessor | Service | Data category | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Payment processor (not yet engaged) | Billing is not enabled during the open beta, so no payment data is processed today. | None at present. When paid plans launch: billing contact, company name, country and VAT ID only — never card numbers. | — | A PCI-DSS-compliant payment processor will be listed here, under SCCs and a signed DPA, before paid plans launch. |
5. Support & operations
| Subprocessor | Service | Data category | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Error monitoring & observability provider | Crash reporting, performance monitoring, log aggregation. | Error stack traces, request metadata, internal user IDs. | EU / EEA, or a jurisdiction covered by an adequacy decision or SCCs. | Standard Contractual Clauses and the provider's Data Processing Agreement. |
6. Analytics & advertising
| Subprocessor | Service | Data category | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Google LLC | Google Ads conversion measurement (gtag) on the marketing site and dashboard. | Ad-click identifiers (gclid), conversion events, device/browser metadata, _gcl_* cookies. | United States and global infrastructure. | Standard Contractual Clauses; Google Ads Data Processing Terms. |
| Yandex LLC | Yandex Metrica — product analytics, clickmap, and Webvisor session replay, on public pages only (not the signed-in dashboard). | Usage and interaction data, session-replay recordings of page interactions, device/browser metadata, _ym_* cookies. | Russian Federation and EEA (provider infrastructure). | The provider's data-processing terms. |
7. Change notifications
We will give Customers at least 30 days' advance notice of any planned addition or replacement of a subprocessor by updating this page and emailing the primary account contact for each affected Customer. The notice will identify the new subprocessor, the service it will perform, and the data category involved.
To receive these notices reliably, ensure your account email is current; you may also subscribe to a dedicated legal-updates list at [email protected].
8. Right to object
Where Customer has a reasonable data-protection objection to a new subprocessor, Customer may notify us within 15 days of the change-notification. We will work with Customer in good faith to find a resolution; if none is reached, Customer may terminate the affected part of the Service without penalty, by written notice to [email protected].