Sub-processors
Every company that processes personal data on our behalf, under GDPR Article 28. Last updated 2 September 2026.
Processing data today.
| Provider | Purpose of processing | Processing location |
|---|---|---|
Stripe Payments Europe, Limited Ireland (group parent: Stripe, Inc., United States) | Payment processing and subscription billing for paid plans Receives your name and email address so it can identify a payment. Card details are entered on Stripe's own pages and never reach ShieldSync. Transfers outside the EEA rely on the Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. Stripe is also an independent controller of payment data for fraud prevention and its own regulatory duties. | Ireland, with transfers to Stripe's group outside the EEA |
Mailtrap Railsware Products Studio LLC | Transactional email (verification, password reset, invitations) — pre-launch capture only Currently a sandbox mailbox: it captures outbound mail for testing and does not deliver to recipients. | European Union |
Named categories, not yet companies.
Because the contracts are not signed. Each will be listed here by name, with its processing location and agreement in place, before it handles any customer data.
| Category | Purpose of processing | Intended location |
|---|---|---|
S3-compatible object storage provider To be confirmed before launch | Encrypted file storage for Cloud accounts ShieldSync stores only client-side-encrypted blobs, so the provider receives ciphertext and never a key. | European Union |
Transactional email provider To be confirmed before launch | Delivery of verification, password reset and invitation email Replaces the sandbox above when real delivery is switched on. | European Union |
Analytics or error reporting None engaged | None engaged - listed so this page records what is absent as well as what is present ShieldSync runs no analytics, no advertising and no crash reporting. If that changes, the provider appears in the table above before it processes anything. | - |
What we require of a sub-processor.
Before a provider processes customer data on our behalf we put a written agreement in place meeting Article 28(3) of the GDPR: processing only on our documented instructions, a confidentiality undertaking from their personnel, appropriate security measures, our written authorisation before they engage anyone further, assistance with data-subject requests and breach notification, and deletion or return of the data when the service ends. Where a provider processes data outside the EEA, transfers rely on the European Commission’s standard contractual clauses.
Get notified of changes.
We will email you 30 days before appointing a new sub-processor, so you have time to review it or object under our DPA.