This list is part of the Data Processing Agreement. It names the third parties BehindGate engages to process Personal Data on behalf of customers, what they do, and where they process data.
Sub-processors
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS) | Cloud infrastructure: storage, compute, databases, secrets, transactional email, content delivery network, and identity service for administrator accounts | Data at rest in eu-west-1 (Ireland). Content delivery and Viewer authentication run at AWS edge locations worldwide. Certain CloudFront supporting services run in us-east-1 (United States). | EU-US Data Privacy Framework where the recipient is certified, otherwise the Standard Contractual Clauses in the AWS Data Processing Addendum |
| Google Cloud EMEA Limited (Google Workspace) | Business email and support communications with customer administrators | European Union, with support from Google LLC in the United States | EU-US Data Privacy Framework where the recipient is certified, otherwise the Standard Contractual Clauses in the Google Cloud Data Processing Addendum |
| Slack Technologies Limited (Slack) | Internal notifications and support coordination | European Union, with support from Salesforce, Inc. in the United States | EU-US Data Privacy Framework where the recipient is certified, otherwise the Standard Contractual Clauses in the Slack Data Processing Addendum |
Google Workspace and Slack are listed here because a support request or an internal notification can carry Viewer data, even though their main use is BehindGate’s own account and support communications.
Vendors that BehindGate uses as controller for its own account, billing, and product data, such as the payment processor and dashboard analytics, are not sub-processors and are named in the Privacy Policy.
Vendors that are not sub-processors
The marketing website behindgate.com uses Plausible Analytics (Plausible Insights OÜ, Estonia), which collects aggregated, cookieless statistics about website visitors. It never receives customer Personal Data, Viewer data, or Customer Content and is therefore not a sub-processor. It is listed here for transparency.
Changes and notification
BehindGate notifies account administrators by email at least 30 days before adding or replacing a sub-processor, as described in Section 6 of the DPA. The current version of this list and its effective date are always published at behindgate.com/legal/subprocessors.