Subprocessors

To deliver our Services seamlessly, Alleo partners with a select group of trusted third-party service providers (“Subprocessors”). These Subprocessors provide essential infrastructure, hosting, communication, analytics, payment, and support services to ensure the Alleo platform remains secure, efficient, and highly reliable for your team.

We maintain this page to give our clients clear and transparent insight into the Subprocessors we use, where data is processed, and the security measures in place. The specific Subprocessors involved in handling your data depend on the specific features and Services your organization uses on Alleo. Therefore, not all Subprocessors listed below will apply to every corporate client.

We update this page from time to time to reflect any changes in our Subprocessor network. Clients will be notified of these updates in compliance with the notification procedures outlined in our Data Processing Agreement (DPA).

‍

Subprocessor	Location of Processing	Scope of Services	Transfer Mechanism / Details
Alleo Subprocessors
Amazon Web Services (Amazon Web Services EMEA SARL; Amazon Web Services, Inc.)	Primary Data Residency: Ireland (eu-west-1). Contracting Entity (for EU clients): Amazon Web Services EMEA SARL, Luxembourg. Parent/Affiliates: Amazon Web Services, Inc. (USA).	Hosting / IaaS: VM/containers, object storage, databases, backups, networking, monitoring.	Data stored in EU regions; support/maintenance may require access from outside the EEA. Covered by the AWS GDPR DPA and EU SCCs.
Intercom (Intercom R&D Unlimited Company; Intercom, Inc.)	Primary Data Residency: Ireland. Contracting Entity (EU clients): Intercom R&D Unlimited Company (IE). Parent/Affiliates: Intercom, Inc. (USA).	Customer support and engagement platform, live chat, email messaging.	Certain processing/support may involve transfers to the USA. Covered by SCCs in the Intercom DPA.
Google Workspaces / Google Cloud (Google Ireland Limited; Google LLC)	Primary Data Residency: EU (datacenter clusters in Belgium, Finland, Ireland, Netherlands). Contracting Entity (EU clients): Google Ireland Limited. Parent/Affiliates: Google LLC (USA).	Productivity and collaboration tools: email, document storage, video conferencing, calendar services.	Google may transfer data to the USA or other countries for support/processing. Covered by SCCs and Google's DPA.
Slack (Slack Technologies Limited (IE); Slack Technologies, LLC (US))	Primary Data Residency: Germany (Frankfurt – EU data center). Contracting Entity (EU clients): Slack Technologies Limited. Parent/Affiliates: Slack Technologies LLC / Salesforce, Inc. (USA).	Team collaboration and communication platform: messaging, file sharing, project collaboration.	Slack may transfer data to the USA for delivery/support. Covered by SCCs and Salesforce BCRs.
HubSpot (HubSpot Ireland Limited; HubSpot, Inc.)	Primary Data Residency: Germany (Frankfurt EU data center). Contracting Entity (EU clients): HubSpot Ireland Limited. Parent/Affiliates: HubSpot, Inc. (USA); HubSpot Germany GmbH (support).	CRM, marketing automation, contact management, email, analytics, customer engagement tools.	Transfers outside the EEA covered by SCCs in the HubSpot DPA.
Stripe (Stripe Payments Europe, Ltd.; Stripe, Inc.)	Primary Data Residency: Europe (primarily Ireland). Contracting Entity (EU clients): Stripe Payments Europe, Limited (Ireland). Parent/Affiliates: Stripe, Inc. (USA) and group companies worldwide.	Processing of user payments to Alleo.	Certain support/processing may occur outside the EEA. Covered by SCCs and the Stripe DPA; Stripe is certified under the EU-U.S. Data Privacy Framework.
CashOut (CashOut B.V.)	Primary Data Residency: Netherlands. Contracting Entity: CashOut B.V. (NL).	Processing of budget payouts by Alleo to users.	Data processing within the EU; no transfers outside the EEA.