Subprocessors

To deliver our Services, Alleo utilizes a limited number of carefully selected third-party service providers (“Subprocessors”). These Subprocessors provide infrastructure, hosting, communication, analytics, payment, and other support services that contribute to the secure and efficient operation of the Alleo platform.

We maintain this page to give our customers transparent insight into which Subprocessors we engage, where data processing occurs, and what safeguards are in place. The specific Subprocessors used for your data processing depend on the functionalities and Services you use from Alleo. Not every Subprocessor listed below is applicable to every customer.

We will update this page from time to time to reflect changes in our Subprocessors. Customers will be informed of such changes in accordance with the notification provisions as set out in our Data Processing Agreement (DPA).

‍

Subprocessor	Location of Processing	Scope of Services	Transfer Mechanism / Explanation
Alleo Subprocessors
Amazon Web Services (Amazon Web Services EMEA SARL; Amazon Web Services, Inc.)	Primary data residency: Ireland (eu-west-1). Contracting party (for EU customers): Amazon Web Services EMEA SARL, Luxembourg. Parent/affiliated companies: Amazon Web Services, Inc. (USA).	Hosting / IaaS: VM/containers, object storage, databases, backups, networks, monitoring.	Data stored in EU regions; support/maintenance may require access from outside the EEA. Covered by the AWS GDPR DPA and EU-SCCs.
Intercom (Intercom R&D Unlimited Company; Intercom, Inc.)	Primary data residency: Ireland. Contracting party (EU customers): Intercom R&D Unlimited Company (IE). Parent/affiliated companies: Intercom, Inc. (USA).	Customer support and engagement platform, live chat, email messaging.	Certain processing/support may involve transfer to the USA. Covered by SCCs in the Intercom DPA.
Google Workspaces / Google Cloud (Google Ireland Limited; Google LLC)	Primary data residency: EU (datacenter cluster in Belgium, Finland, Ireland, Netherlands). Contracting party (EU customers): Google Ireland Limited. Parent/affiliated companies: Google LLC (USA).	Productivity and collaboration tools: email, document storage, video conferencing, calendar services.	Google may transfer data to the USA or other countries for support/processing. Covered by SCCs and Google's DPA.
Slack (Slack Technologies Limited (IE); Slack Technologies, LLC (USA))	Primary data residency: Germany (Frankfurt – EU datacenter). Contracting party (EU customers): Slack Technologies Limited. Parent/affiliated companies: Slack Technologies LLC / Salesforce, Inc. (USA).	Team collaboration and communication platform: messaging, file sharing, project collaboration.	Slack may transfer data to the USA for delivery/support. Covered by SCCs and Salesforce BCRs.
HubSpot (HubSpot Ireland Limited; HubSpot, Inc.)	Primary data residency: Germany (Frankfurt EU datacenter). Contracting party (EU customers): HubSpot Ireland Limited. Parent/affiliated companies: HubSpot, Inc. (USA); HubSpot Germany GmbH (support).	CRM, marketing automation, contact management, email, analytics, customer engagement tools.	Transfers outside the EEA covered by SCCs in the HubSpot DPA.
Stripe (Stripe Payments Europe, Ltd.; Stripe, Inc.)	Primary data residency: Europe (primarily Ireland). Contracting party (EU customers): Stripe Payments Europe, Limited (Ireland). Parent/affiliated companies: Stripe, Inc. (USA) and group companies worldwide.	Processing of payments by users to Alleo.	Certain support/processing may occur outside the EEA. Covered by SCCs and the Stripe DPA; Stripe certified under the EU-USA Data Privacy Framework.
CashOut (CashOut B.V.)	Primary data residency: Netherlands. Contracting party: CashOut B.V. (NL).	Processing of budget payouts by Alleo to users.	Data processing within the EU; no transfers outside the EEA anticipated.