Sub-processors
Last updated: May 6, 2026
Product7, Inc. engages a small number of carefully selected third-party service providers ("Sub-processors") to help deliver our Services. This page lists every Sub-processor that may process Customer Data on our behalf, the purpose of the engagement, and the categories of data involved.
What is a Sub-processor?
A Sub-processor is a third party engaged by Product7 to process Customer Data in connection with the delivery of our Services. Each Sub-processor is bound by a written agreement that imposes data protection obligations no less protective than those in our Data Processing Agreement (DPA), consistent with GDPR, UK GDPR, and CCPA/CPRA requirements.
Customer-initiated integrations (for example, connecting your own Slack workspace or Jira instance to Product7) are listed separately as Optional Integrations. Those services act as Sub-processors only when the customer enables the integration.
Infrastructure & Hosting
Amazon Web Services (AWS)
Privacy policy ↗- Purpose
- Primary cloud infrastructure, compute, and object storage (S3) for application data, user uploads, and backups.
- Data processed
- All Customer Data and Service Data
- Location
- United States, European Union
MongoDB, Inc. (MongoDB Atlas)
Privacy policy ↗- Purpose
- Managed document database hosting for analytics, event, and operational data.
- Data processed
- Customer Data, usage and event data
- Location
- United States, European Union
Cloudflare, Inc.
Privacy policy ↗- Purpose
- Content delivery network, DDoS protection, custom-domain hosting, edge KV, and static site delivery (Cloudflare Pages).
- Data processed
- Request metadata, IP addresses, cached static assets
- Location
- Global edge network
Bunny.net (BunnyWay d.o.o.)
Privacy policy ↗- Purpose
- Legacy content delivery network and storage zones for help center and web portal assets. Being phased out in favor of Cloudflare.
- Data processed
- Cached static assets, request metadata
- Location
- European Union (Slovenia), global edge network
Email Delivery
Postmark (ActiveCampaign, LLC)
Privacy policy ↗- Purpose
- Transactional email delivery (account, notification, and support emails).
- Data processed
- Recipient email addresses, email content, delivery metadata
- Location
- United States
Resend, Inc.
Privacy policy ↗- Purpose
- Transactional email delivery and inbound email routing for support inboxes.
- Data processed
- Recipient email addresses, email content, delivery metadata
- Location
- United States
Payments
Paystack Payments Limited
Privacy policy ↗- Purpose
- Payment processing, subscription billing, and invoicing.
- Data processed
- Billing contact details, transaction metadata. Card details are processed directly by Paystack and never stored by Product7.
- Location
- Nigeria, South Africa, United States
AI & Machine Learning
Anthropic, PBC
Privacy policy ↗- Purpose
- Large language model APIs powering Aria, AI duplicate detection, AI summaries, and other AI-assisted features.
- Data processed
- Feedback content, support messages, and other text submitted to AI features. Processed under a zero-retention agreement; not used to train Anthropic's models.
- Location
- United States
Voyage AI Innovations Inc.
Privacy policy ↗- Purpose
- Text embedding generation for semantic search and similarity scoring.
- Data processed
- Feedback titles and descriptions sent for embedding. Not used to train Voyage's models.
- Location
- United States
Authentication
Google LLC
Privacy policy ↗- Purpose
- Optional Google Sign-In (OAuth 2.0) for end-user authentication.
- Data processed
- Email address, name, and profile picture as authorized by the user during sign-in.
- Location
- United States
Optional Integrations (Customer-Enabled)
Slack Technologies, LLC
Privacy policy ↗- Purpose
- Optional integration. When enabled by the customer, Product7 sends notifications and feedback events to the customer's Slack workspace.
- Data processed
- Feedback events and notification metadata as configured by the customer
- Location
- United States
Reddit, Inc.
Privacy policy ↗- Purpose
- Optional integration. When enabled by the customer, Product7 ingests and posts on Reddit using the customer's authorized account.
- Data processed
- Posts, comments, and account metadata as authorized by the customer
- Location
- United States
Notification of Changes
Product7 reviews this list regularly and updates it whenever a Sub-processor is added, removed, or its scope materially changes. We will provide at least 30 days' advance notice of any new Sub-processor or material change before it begins processing Customer Data.
To be notified of changes, email privacy@product7.io with the subject line "Subscribe to Sub-processor Updates".
If a customer with an executed DPA objects to a new Sub-processor on reasonable data-protection grounds, the customer may terminate the affected Service in accordance with the DPA.
Contact
Privacy inquiries: privacy@product7.io
Data Protection Officer: dpo@product7.io
Related: Privacy Policy