Eleven companies.
All of them, not the highlights.
Everyone who could touch customer data is on this page, with what they do and where they run it. If a vendor is not listed here, we are not using them.
1Current sub-processors#
Listed in order of how much data each one sees, infrastructure first. Every entry is bound by written terms no less protective than our Data Processing Addendum, and we remain liable to you for all of them.
| Sub-processor | Purpose | Data seen | Location | Transfer basis | Since |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Primary hosting, storage and backups for the API and entity graph | Customer content, query inputs, logs | Ireland · Germany (eu-west-1, eu-central-1) | None — EU only | 2023-02 |
| Amazon Web Services, Inc. | Optional us-east-1 and ap-southeast-1 regions, only if you pin a key there | Customer content for keys pinned to that region | United States · Singapore | SCCs + EU-US DPF | 2024-05 |
| Cloudflare, Inc. | DNS, TLS termination, DDoS protection and edge rate limiting | IP address, request metadata; no request bodies | Global edge · EU-first routing | SCCs + EU-US DPF | 2023-02 |
| Neon Inc. | Managed Postgres for the control plane (accounts, keys, usage counters) | Account data, API key metadata, usage records | Germany (eu-central-1) | SCCs | 2024-01 |
| Snowflake Inc. | Warehouse share delivery, for customers who enable it | Entity reference data; no query inputs | Ireland (EU deployment) | SCCs | 2025-03 |
| Stripe Payments Europe, Ltd. | Card payment processing and invoicing | Billing contact, card token, invoice history | Ireland | SCCs for US support access | 2023-04 |
| Zendesk International Ltd. | Support ticketing | Name, work email, ticket content you send us | Ireland | SCCs | 2023-06 |
| Slack Technologies Limited | Shared support channels on Business and Enterprise | Name, work email, message content | Ireland | SCCs + EU-US DPF | 2024-02 |
| Datadog, Inc. | Application metrics, traces and error monitoring | Request metadata, sampled trace IDs; inputs are redacted | Germany (EU site) | SCCs | 2023-03 |
| Google Ireland Limited | Workspace: business email, documents and calendars | Business contact data and correspondence | EU data regions | SCCs + EU-US DPF | 2023-02 |
| Plausible Insights OÜ | Cookieless website analytics for spotit.ai | Aggregate page views; no cookie, no cross-site identifier | Estonia | None — EU only | 2023-02 |
Nine of the eleven only ever hold EU-resident data. The two that can hold data elsewhere do so only if you pin a key outside the EU, or when a US support engineer opens a ticket you sent.
2Where your data actually sits#
An account is pinned to one region and stays there. The default is eu-central-1 in Frankfurt, with eu-west-1 in Dublin as the failover — and failover does not leave the EU, which is the part most residency commitments quietly omit.
| Region | Ingest & graph | Query inputs | Logs | Backups |
|---|---|---|---|---|
| eu-central-1 · Frankfurt | EU | EU | EU | EU |
| eu-west-1 · Dublin | EU | EU | EU | EU |
| us-east-1 · N. Virginia | US replica | US | US | US |
| ap-southeast-1 · Singapore | SG replica | SG | SG | SG |
Enterprise plans can pin a key to one region contractually, so that a misconfigured client cannot send data to another one. See enterprise and add-ons.
3Notice of change#
We announce a new or replacement sub-processor at least 30 days before it starts processing. Notice goes to every account owner by email and appears on this page and on the changelog at the same time.
To add a compliance mailbox to the notification list, or to receive it as a webhook, write to privacy@spotit.ai with the address you want on it.
4Objecting to a sub-processor#
You may object on reasonable data protection grounds within the notice period. Send the objection and the reason to privacy@spotit.ai.
- We will look for a configuration that keeps you off the new sub-processor — usually possible for anything that is not core infrastructure.
- If we cannot, we will tell you plainly rather than run out the clock.
- You may then terminate the affected part of the service and we will refund prepaid, unused fees for it.
5Change history#
Additions, removals and region moves since we started publishing this page.
| Date | Change | Type |
|---|---|---|
| 2026-03-02 | Added Snowflake Inc. for warehouse share delivery | added |
| 2025-11-18 | Removed Mixpanel; product analytics moved in-house | removed |
| 2025-06-09 | Datadog moved from the US site to the EU site | changed |
| 2025-02-24 | Added Slack Technologies Limited for shared support channels | added |
| 2024-10-07 | Removed Intercom; support consolidated on Zendesk | removed |
Something here that does not work for you?
Redlines on the self-serve terms are read, not filed. Send them and you will get an answer from someone who can change the document, usually inside two working days.
Spotit Ltd · Registered in Ireland, company no. 742118 · 14 Hanover Quay, Grand Canal Dock, Dublin 2, D02 XY88, Ireland · VAT IE4218806T