Sub-processors
Last updated:
The third parties that process personal data for Surge Service, what they do, where they are and how transfers are safeguarded.
Draft for legal review
This document has 9 open points, highlighted below. They will be resolved before the document takes effect.
Sales-Surge B.V. engages the sub-processors below to provide Surge Service. This list forms annex 3 of our Data Processing Agreement.
1.How this list works
- Customers give general authorisation for the sub-processors on this page when they accept the Data Processing Agreement.
- We announce a new or replaced sub-processor at least 30 days in advance, by email to the admins of every customer account and on this page.
- Customers can object within those 30 days on reasonable data protection grounds, as described in the Data Processing Agreement.
- Every sub-processor is bound by a written contract with data protection obligations at least as strict as ours.
2.Current sub-processors
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Managed database that stores all Customer Data. | All categories listed in annex 1 of the DPA. | Open point: [database region, to confirm; for example EU (Frankfurt)] | Data stored in the EEA. SCCs for any access from outside the EEA. Open point: [confirm against the Supabase DPA] |
| Cloudflare, Inc. | Application hosting and network edge: serving the app, encrypting traffic and blocking attacks. | All data that passes through the app, and request logs with IP addresses. | Global network, with processing close to the user. Open point: [confirm the production hosting provider and region. Since 1 October 2026 production runs on Lovable hosting (Cloudflare Workers) with the database in Lovable Cloud (managed Supabase); decide whether Lovable must be listed as a sub-processor] | SCCs and the EU-US Data Privacy Framework. Open point: [confirm certification and DPA version] |
| Postmark Open point: [confirm contracting entity] | Sending ticket replies, CSAT surveys and portal sign-in links, and receiving forwarded email. | Names and email addresses of senders and recipients, message content and attachments. | United States | SCCs. Open point: [confirm the transfer mechanism in the Postmark DPA] |
| Stripe Payments Europe, Limited, with Stripe, Inc. | Subscription payments, invoices and the billing portal. | Name and email address of the billing contact, company details, VAT number and payment details. | Ireland and United States | SCCs and the EU-US Data Privacy Framework. Open point: [confirm against the Stripe DPA] |
| Anthropic Open point: [confirm contracting entity for customers in the EEA] | Optional AI features: classifying messages, account briefs and reply drafts. Only for customers who switch AI on. | Ticket content and the account context needed for a request. | United States | SCCs (modules 2 and 3), incorporated in Anthropic's Data Processing Addendum. |
3.Notes
- AI is opt-in. Anthropic receives data only after an admin of the customer switches AI features on. Anthropic's Commercial Terms of Service state: "Anthropic may not train models on Customer Content from Services." Open point: [confirm Anthropic's current retention period for API data]
- Stripe handles billing, not Customer Data. Stripe processes the billing details of our customers, for which we are the controller, see our Privacy Policy. For some processing, such as fraud prevention and financial regulation, Stripe acts as an independent controller under its own privacy policy. Full card details never reach our systems.
- Email. Replies and surveys that agents send are delivered through Postmark. Customer replies come back through Postmark and are added to the right ticket.
4.Data source: Pipedrive
Pipedrive (Pipedrive OÜ and its affiliates) is not our sub-processor. The customer engages Pipedrive directly and grants our app access to its Pipedrive account during installation. We read persons, organisations, deals, products, activities and users through that access and write activities, notes, leads and deals back on the customer's instruction. The customer's agreement with Pipedrive governs how Pipedrive processes that data, and the customer's Pipedrive data region determines where it is stored.
5.Change history
| Date | Change |
|---|---|
| 30 September 2026 | First version of this list. |
Questions about our sub-processors go to info@sales-surge.nl.