Sub-processor

Location of processing

Scope of Service

Transfer Mechanism / Notes

Amazon Web Services  (Amazon Web Services EMEA SARL; Amazon Web Services, Inc.)

Primary data residency: Ireland (eu-west-1).

Contracting entity: Amazon Web Services EMEA SARL, Luxembourg.

Parent/affiliates: Amazon Web Services, Inc. (US).

Hosting / IaaS: VM/containers, object storage, databases, backups, networking, monitoring.

Data stored in EU regions; support/maintenance may involve access from outside the EEA. Safeguarded by AWS GDPR Data Processing Addendum and EU SCCs.

Intercom (Intercom R&D Unlimited Company, Intercom, Inc.)

Primary data residency: Ireland.

Contracting entity (EU customers): Intercom R&D Unlimited Company (IE).

Parent/affiliates: Intercom, Inc. (US).

Customer support and engagement platform, live chat, email messaging

Some processing/support may involve transfers to the US. Safeguarded by SCCs under Intercom’s DPA.

Google Workspaces  / Google Cloud (Google Ireland Limited; Google LLC)

Primary data residency: EU (Belgium, Finland, Ireland, Netherlands — data center cluster).

Contracting entity (EU customers): Google Cloud EMEA Limited.

Parent/affiliates: Google LLC (US).

Productivity and collaboration tools: email, document storage, video conferencing, calendar services

Google may transfer data to US or other countries for support/processing. Safeguarded by SCCs and Google’s DPA.

Slack
(Slack Technologies Limited (IE); Slack Technologies, LLC (US))

Primary data residency: Germany (Frankfurt — EU primary data center).

Contracting entity (EU customers): Slack Technologies Limited (UK/IEt).

Parent/affiliates: Slack Technologies LLC / Salesforce, Inc. (US).

Team collaboration and communication platform: messaging, file sharing, project collaboration

Slack may transfer data to the US for delivery/support. Safeguarded by SCCs and Salesforce Binding Corporate Rules (BCRs).

Hubspot (HubSpot Ireland Limited; HubSpot, Inc.)

Primary data residency: Germany (Frankfurt EU data center).

Contracting entity (EU customers): HubSpot Ireland Limited.

Parent/affiliates: HubSpot, Inc. (US); HubSpot Germany GmbH (support role).

CRM, marketing automation, contact management, email messaging, analytics, customer engagement tooling.

Transfers outside EEA safeguarded by SCCs under HubSpot’s DPA.

Stripe
(Stripe Payments Europe, Ltd.; Stripe, Inc.)

Primary data residency: Europe (primarily Ireland).

Contracting entity: Stripe Payments Europe, Limited (Ireland).

Parent/affiliates: Stripe, Inc. (US) and group companies worldwide.

Processing of payments by Alleo users to Alleo

Some support/processing may occur outside the EEA. Transfers safeguarded by SCCs and Stripe’s DPA; Stripe also certified under EU-US Data Privacy Framework.

CashOut  (CashOut B.V.)

Primary data residency: Netherlands.

Contracting entity: CashOut B.V. (NL).

Processing of budget pay outs to Alleo users

Data processed within the EU; no transfers outside the EEA foreseen.

Sentry

EU – Frankfurt, Germany (AWS).

For application monitoring and error tracking to ensure the stability and performance of the Alleo platform.

Data is stored within the EU; there is no transfer to a third country for the core storage. For limited flows (support, backups, certain sub-processors), transfer to the US may still occur, covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

Braze

EU – EU instance (AWS, Frankfurt).

Sending user communications and in-app messaging to Alleo users.

Data is hosted within the EU. Residual transfers to the US (e.g., support and sub-processors) are covered by the EU-US Data Privacy Framework, SCCs, and the UK Addendum.

Zendesk

EU instance (AWS, Frankfurt).

Managing customer support requests and communications.

Primary storage within the EU. Data residency controls hosting, not processing; even with EEA hosting, some processing may occur outside the EU. Residual transfers covered by the EU-US DPF, SCCs, and Binding Corporate Rules (BCRs).

Posthog

EU – Frankfurt, Germany (AWS eu-central-1).

Product analytics and tracking user behavior within the Alleo platform.

Data is stored within the EU; there is no transfer to a third country for the core storage. Where transfer to the US does occur, Standard Contractual Clauses (SCCs) apply; PostHog also participates in the Data Privacy Framework.