Subprocessors
Last updated: July 2026
TrustScan engages the following subprocessors to provide our compliance scanning services. We regularly review our subprocessor list and update this page when changes occur.
Cloudflare, Inc.
- Purpose:
- Cloud Infrastructure & Hosting
- Data Processed:
- Customer account data, scan results, session data, website scan content
- Location:
- Global (Edge Network) — 330+ cities in 120+ countries
- Entity:
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
- Safeguards:
- Standard Contractual Clauses (SCCs); Cloudflare is EU-US Data Privacy Framework certified
Stripe, Inc.
- Purpose:
- Payment Processing
- Data Processed:
- Payment card details (processed by Stripe; TrustScan does not store card data)
- Location:
- United States
- Entity:
- Stripe, Inc., 510 Townsend St, San Francisco, CA 94103, USA
- Safeguards:
- Standard Contractual Clauses (SCCs); Stripe is EU-US Data Privacy Framework certified; PCI DSS Level 1 certified
Resend, Inc.
- Purpose:
- Email Delivery
- Data Processed:
- Email addresses, notification content
- Location:
- United States
- Entity:
- Resend, Inc.
- Safeguards:
- Standard Contractual Clauses (SCCs)
PostHog, Inc.
- Purpose:
- Product Analytics (consent-based)
- Data Processed:
- Product usage events, page views, feature interactions
- Location:
- United States (self-hosted option available)
- Entity:
- PostHog, Inc., 2261 Market St #4268, San Francisco, CA 94114, USA
- Safeguards:
- Standard Contractual Clauses (SCCs); data minimization enabled
Google LLC
- Purpose:
- Website Analytics & Performance (consent-based)
- Data Processed:
- Page views, usage patterns, performance metrics
- Location:
- United States
- Entity:
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- Safeguards:
- Standard Contractual Clauses (SCCs); Google is EU-US Data Privacy Framework certified
Notification of Changes
If we engage a new subprocessor or change a subprocessor's role in processing personal data, we will update this page and notify customers via email at least 14 days before the new subprocessor begins processing. Customers may object to such changes by contacting legal@trustscanaudit.com.
Questions about our subprocessors? Contact us at privacy@trustscanaudit.com