Sequence Commerce
Subprocessors List
Sequence Commerce’s current subprocessor list for enterprise DPA and GDPR compliance. Includes AWS, Cloudflare, and all third-party services processing customer data.
Last Updated: October 1, 2026
This page lists third-party subprocessors that Sequence Commerce uses to provide our services. We ensure all subprocessors meet our strict data protection and security standards.
What Are Subprocessors?
Subprocessors are third-party services that process personal data on our behalf to help us deliver our services to you. We carefully vet each subprocessor to ensure they maintain appropriate security and privacy standards.
Our Subprocessor Standards
All subprocessors must:
- Sign data processing agreements
- Implement appropriate security measures
- Comply with applicable privacy laws
- Undergo regular security assessments
- Limit data use to specified purposes
- Delete data upon termination
Current Subprocessors
Cloud Infrastructure
Amazon Web Services, Inc. (AWS)
- Purpose: Cloud hosting and data storage
- Data Processed: All platform data
- Location: United States, EU (customer data stays in selected region)
- Compliance: GDPR compliant Security practices aligned with ISO 27001 controls (certification held by underlying cloud infrastructure subprocessors, not by Sequence Commerce)
Cloudflare, Inc.
- Purpose: Content delivery network and DDoS protection
- Data Processed: Traffic data, IP addresses
- Location: Global network
- Compliance: Security practices aligned with ISO 27001 controls (certification held by underlying cloud infrastructure subprocessors, not by Sequence Commerce)
Communication Services
SendGrid, Inc. (Twilio)
- Purpose: Transactional email delivery
- Data Processed: Email addresses, email content
- Location: United States
- Compliance: Security practices aligned with ISO 27001 controls (certification held by underlying cloud infrastructure subprocessors, not by Sequence Commerce)
Twilio Inc.
- Purpose: SMS notifications and communications
- Data Processed: Phone numbers, message content
- Location: United States
- Compliance: Security practices aligned with ISO 27001 controls (certification held by underlying cloud infrastructure subprocessors, not by Sequence Commerce)
Analytics & Performance
Google LLC (Google Analytics)
- Purpose: Website analytics
- Data Processed: Usage data, anonymized IP addresses
- Location: United States
- Compliance: EU-U.S. Data Privacy Framework, Standard Contractual Clauses
CRM
HubSpot, Inc.
- Purpose: Customer relationship management
- Data Processed: Contact details, communication history
- Location: United States
- Compliance: SOC 2
Marketing & Advertising
Facebook, Inc. (Meta)
- Purpose: Advertising and retargeting
- Data Processed: Hashed email addresses, conversion data
- Location: United States, Ireland (EU)
- Compliance: EU-U.S. Data Privacy Framework, Standard Contractual Clauses
EasyPost, Inc.
- Purpose: Multi-carrier shipping API
- Data Processed: Shipping information, tracking data
- Location: United States
- Compliance: SOC 2
Reviews & Ratings
Trustpilot A/S
- Purpose: Customer reviews platform
- Data Processed: Customer names, review content
- Location: Denmark (EU)
- Compliance: GDPR compliant
Updates to Subprocessors
Notification Process
We notify customers of subprocessor changes through:
- Email notifications (for material changes)
- Updates to this page
- Account dashboard notifications
Objection Rights
If you have concerns about a new subprocessor:
- Submit objections within 30 days of notification
- We’ll work to address your concerns
- Alternative arrangements may be available
Data Processing Agreements
All subprocessors have signed Data Processing Agreements (DPAs) that include:
- Confidentiality obligations
- Security requirements
- Audit rights
- Data deletion requirements
- Breach notification procedures
- Sub-subprocessor restrictions
Regional Considerations
EU/UK Data
For customers in the EU/UK:
- Data remains in EU data centers where possible
- Standard Contractual Clauses in place
- Additional safeguards per Schrems II
Data Localization
We can accommodate data localization requirements for:
- Enterprise customers
- Regulated industries
- Specific geographic requirements
Security Assessments
Subprocessors undergo:
- Initial security review
- Security guidance provided to personnel
- Continuous monitoring
- Written incident response procedures
Access Requests
Subprocessors assist with:
- Data subject access requests
- Correction requests
- Deletion requests
- Data portability
All requests should be submitted to Sequence Commerce first.
Questions or Concerns?
For questions about our subprocessors:
Contact Information: Email: contact@sequencecommerce.com
Subject: Subprocessor Inquiry
Response Time: Within 5 business days
This list represents our current subprocessors. We reserve the right to engage new subprocessors in accordance with our notification procedures and applicable law.