Sub-processor List
Document status: Approved v1.8 (2026-10-17) Last updated: 2026-10-17
What is a sub-processor?
A sub-processor is a third party that processes Personal Information on SurveyRock’s behalf to help us deliver the Service. We engage sub-processors only where they meaningfully improve our ability to provide the Service securely and effectively.
We require each sub-processor to:
- Sign a written agreement requiring them to protect Personal Information in accordance with applicable law
- Provide a Data Processing Addendum (DPA) where Personal Information of EU/UK residents is involved
- Implement appropriate technical and organizational security measures
- Notify us of any data breach without undue delay
Notification of changes
We notify Customers of material changes to this list at least 30 days in advance by:
- Posting the updated list here
- Sending email to the primary contact on each Account
- In-app notification
Customers may object to a new sub-processor by emailing privacy@surveyrock.com within 30 days. If we cannot accommodate a reasonable objection, the Customer may terminate the affected service with a proportionate refund of prepaid fees — the full objection mechanism is in Section 4.4.3 of our DPA.
Current sub-processors
Infrastructure and hosting
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Primary cloud hosting — compute, storage, networking, database | All Personal Information stored in the Service | EU (Stockholm) | https://aws.amazon.com/compliance/gdpr-center/ |
| Vercel | Marketing website and help center hosting, edge delivery | Visitor IP, request metadata, page analytics (no Customer survey data) | US (global edge) | https://vercel.com/legal/dpa |
| Cloudflare | Turnstile CAPTCHA — bot protection on signup, login, survey-taking, and free tools on our website | IP address and browser signals of visitors completing the CAPTCHA check | Global edge | https://www.cloudflare.com/cloudflare-customer-dpa/ |
| IPlocate | IP geolocation for login-security features (new-device/location alerts, session context) | User IP addresses; derived approximate location (city, country, coordinates, timezone) | Available on request | https://www.iplocate.io/privacy |
| Mapbox | Static map images embedded in security-alert emails (visualizing the approximate location of a sign-in) | Approximate coordinates of the login location (derived from IP, embedded in the image URL); the email recipient’s IP and user agent when the mail client loads the image | US | https://www.mapbox.com/legal/dpa |
Payments and billing
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| Paddle | Merchant of Record — payment processing, tax compliance, dunning, invoicing | Billing name, email, address, payment method (not card numbers; Paddle holds those), transaction history | UK, US, EU | https://www.paddle.com/legal/dpa |
Email and communication
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| Postmark (ActiveCampaign) | Transactional email delivery, inbound email parsing | Email addresses (sender/recipient), email content for delivery | US | https://postmarkapp.com/eu-privacy |
| Telnyx | SMS delivery — survey distribution by SMS and SMS one-time passcodes for two-factor authentication | Phone numbers of message recipients (Respondents, contacts, account users), SMS message content, delivery metadata | US | https://telnyx.com/legal/data-privacy |
| Loops (Astrodon Corporation) | Marketing/lifecycle email delivery — sent from the isolated trysurveyrock.com domain, kept separate from surveyrock.com’s transactional reputation |
Recipient email address, first name, account-derived personalization fields, email open/click engagement data; for feedback readout users who ask for follow-up emails, the top theme label, the readout link and the date their file is kept until | US | https://loops.so/dpa |
Customer support
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| ThriveDesk | Email-based customer support inbox, plus a live-chat widget on the marketing site (pricing, the /vs/* comparison pages, contact, managed, the returning-to-SurveyRock help article) and inside the authenticated product (the help panel’s “Start a live chat” button) | Support ticket content, names, emails of Customers requesting support; for the chat widget, visitor page/browsing history on surveyrock.com, chat transcript content, and IP address; for the in-app widget specifically, the Customer’s name and account email | US | https://www.thrivedesk.com/our/privacy/ |
Analytics and observability
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| PostHog | Product and marketing-site analytics, feature usage measurement, session recordings (limited), AI feature usage tracing | Pseudonymized user IDs, event data, page interactions, IP (truncated); Customer survey content and Respondent open-text responses sent when an AI feature is invoked (same data OpenAI receives for that call, sent for usage/quality observability) | EU (PostHog Cloud EU, Frankfurt) | https://posthog.com/dpa |
| BetterStack | Status page hosting, uptime monitoring, log management | Service-level metrics, no Customer survey data | EU | https://betterstack.com/data-processing-agreement |
AI and machine learning
These sub-processors handle data only when Customers actively use AI features. AI providers receive transient data for the duration of the API call; we do not authorize them to train models on Customer Content.
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| OpenAI | LLM provider for AI features (survey generation, open-text theme and sentiment analysis, summaries, AI Query, workflow AI steps, follow-up probes) | Customer survey content and Respondent open-text responses sent when an AI feature is invoked, and comments uploaded to the feedback readout (email addresses and phone numbers removed) (transient; not used for training) | US | https://openai.com/policies/data-processing-addendum |
| Fireworks AI | LLM provider for the open-weight model tier (DeepSeek, Qwen) used by select AI features — disclosed ahead of activation; not yet processing live data as of this listing (see status note below) | Customer survey content and Respondent open-text responses would be sent when an AI feature using this tier is invoked, and comments uploaded to the feedback readout (email addresses and phone numbers removed) when it falls back to this tier (transient; not used for training) | US | https://fireworks.ai/dpa |
| LLM provider, reached directly through the Gemini API for survey theme generation in the designer, and through Portkey for a premium-tier AI feature fallback (survey generation, AI Query) — disclosed ahead of activation, not yet processing live data (see status notes below) | For theme generation: the description and brand inputs a Customer types into the theme prompt. For the Portkey fallback: Customer survey content and Respondent open-text responses would be sent when the fallback is invoked. Transient; Google’s paid-tier terms state prompts/responses are not used to improve its products | Global — Google does not pin where Gemini API data is processed (see status note) | https://ai.google.dev/gemini-api/terms | |
| Anthropic | LLM provider for SurveyRock’s own analysis and report preparation work, including Managed service deliverables — disclosed ahead of use in the product itself (see status note below) | Customer survey content and Respondent open-text responses, where SurveyRock analyses them as part of a Managed engagement or a support request (transient; Anthropic’s Commercial Terms state it may not train models on Customer Content) | US-headquartered (Anthropic, PBC); processing location is not pinned to a region | https://www.anthropic.com/legal/commercial-terms |
| Portkey | LLM gateway for proprietary AI models — the agent fleet’s internal routing, and the product’s fallback path to Google (above) | Same data as the underlying LLM it routes to (Portkey is a proxy); request/response metadata logged for routing and cost analysis | US | https://portkey.ai/dpa |
Fireworks status note (2026-09-11): Fireworks is configured in the application but not yet active — no request has been sent to it, pending a provisioned credential and a verified model configuration. It is listed here, ahead of that activation, in the interest of disclosing before processing rather than after. This replaces the earlier position that DeepSeek and Qwen would be reached through Portkey; they will instead be reached through Fireworks, directly, as described above.
Google status note (2026-09-11): configured as a fallback for two AI features but not yet active — no request has been sent, pending a provisioned credential and a Google integration inside Portkey. Listed here ahead of that activation for the same reason as Fireworks above: disclosure comes before processing, not after.
Google update (2026-10-10): Google is now also configured to be called directly through the Gemini API for survey theme generation, ahead of OpenAI, because it answers fastest. It is not yet active: no request has been sent, pending a paid-tier credential. The Gemini API does not let us choose where it processes data. Google’s paid-tier terms say prompts and responses “may be stored transiently or cached in any country in which Google or its agents maintain facilities”, which is why the location above reads Global rather than a region. Only the paid tier is used.
Anthropic status note (2026-10-10): Anthropic models are what SurveyRock’s own analysis and Managed-service work is done on. Anthropic is listed here so that Customers whose data is analysed by SurveyRock staff, in a Managed engagement or in answering a support request, can see where that analysis runs. Its Commercial Terms state that it may not train models on Customer Content. Anthropic is not used for any self-serve product AI feature as of this listing.
Source code and development
| Sub-processor | Purpose | Data processed | Location | DPA / privacy |
|---|---|---|---|---|
| Atlassian (Bitbucket) | Source code repository, CI/CD pipelines | Source code, deployment metadata, no Customer survey data | Global (US, EU options) | https://www.atlassian.com/legal/data-processing-addendum |
Sub-processors we do NOT use
For clarity with enterprise procurement teams who may ask:
- Paddle is the sole payment provider for all new subscriptions — a small number of legacy subscriptions remain on Stripe pending migration
- We do not use Intercom, HubSpot Service Hub, or Zendesk for support — ThriveDesk only
- We do not use Google Analytics or Adobe Analytics — PostHog (EU Cloud) is our only analytics tool, for both the product and the marketing site
- We do not sell, rent, or share Customer data with marketing data brokers, ad networks, or aggregators
- We do not train any AI models on Customer Content without explicit opt-in
Customer-controlled integrations
Customers can connect SurveyRock to third-party services (Zapier, HubSpot, Salesforce, custom webhooks, etc.). When Customers configure these integrations:
- The third party is not a SurveyRock sub-processor
- The Customer is responsible for the data shared with the third-party service
- The third party’s terms govern that data sharing
- SurveyRock acts as an integration point but does not control or store data on the third party’s behalf
How to verify sub-processor status
Customers can:
- Request the DPA from any listed sub-processor where they have a direct concern
- Object to a sub-processor by emailing privacy@surveyrock.com