VaultN Sub-Processor List
V1.03, Latest Update: 2026-03-28
VaultN engages the following sub-processors to support the provision of its services. Each sub-processor is subject to appropriate technical and organizational measures, including encryption in transit and at rest, role-based access control (RBAC), multi-factor authentication (MFA), secure API and credential management controls, contractual data protection obligations, and, where applicable, Standard Contractual Clauses (SCCs).
Section 1: Sub-Processors
| SUB-PROCESSOR NAME | PROCESSING ACTIVITIES | LOCATION | SECURITY MEASURES | DATE OF ENGAGEMENT | PURPOSE OF PROCESSING |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Cloud infrastructure, development, testing, AI-related services, data storage, and associated technical support services | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q2 2026 | Infrastructure support and platform operations |
| Catamorphic Co., USA | Feature management and configuration services (offered under the trade name LaunchDarkly) | >US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q2 2026 | Feature control and service optimization |
| Cloudflare, Inc., USA | Content delivery, network security, and traffic optimization services | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data | (Q2 2023) Q2 2026 | Network protection, service availability, and performance optimization |
| Microsoft Ireland Operations Ltd, Ireland | Cloud hosting, infrastructure, storage, and networking services (Microsoft Azure) | EEA | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, Microsoft Data Protection Addendum, and where applicable SCCs | Q1 2022 | Core hosting and platform infrastructure |
| Elasticsearch B.V., the Netherlands | Search and analytics services | EEA | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q1 2022 | Search functionality and analytics processing via Elastic Search |
| Twilio Ireland Limited, Ireland | Messaging and communication delivery services | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q1 2022 | Automation of client email processing via SendGrid |
| MaxMind, Inc., USA | Resolving IP address | US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q1 2022 | Fraud prevention and risk management via MaxMind GeoIP/GeoLite |
| Datadog, Inc., USA | Monitoring, logging, and observability services | US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q2 2025 | Performance monitoring via DataDog APM |
| Treblle Limited, UK | API monitoring and analytics services | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q2 2025 | API performance monitoring via API Intelligence |
| Auth0, LLC, USA | Identity and access management services | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data protection obligations, and where applicable SCCs | Q2 2025 | Authentication and access control via Auth0 |
| The Rocket Science Group LLC, USA | Communications with VaultN users | EEA, US | Encryption in transit and at rest, RBAC, MFA, secure API and credential management controls, contractual data | Q2 2025 | Communications and notifications via MailChimp |
Section 2: Independent Third-Party Controllers
| SUB-PROCESSOR NAME | PROCESSING ACTIVITIES | LOCATION | SECURITY MEASURES | DATE OF ENGAGEMENT | PURPOSE OF PROCESSING |
|---|---|---|---|---|---|
| Google Ireland Limited, Ireland | Website analytics services (Google Analytics) provided under Google’s own terms; Google acts as independent controller | EEA, US | Subject to Google Privacy Policy | Q2 2025 (Q3 2023) | Website analytics and service improvement |
| Microsoft Corp., USA | Analytics services (Microsoft Clarity) provided under Microsoft Clarity Terms of Use; Microsoft acts as independent controller | US | Subject to Microsoft Privacy Statement | Q2 2026 | Platform analytics and usability improvement |