Subprocessors
Last updated: 8 October 2026 · Effective from: 8 October 2026
This is the sub-processor notice page referred to in clause 7.3(a) of our standard Data Processing Agreement. It lists every third party that processes customer personal data on our behalf, where that processing happens, and the legal mechanism we rely on for each one. We keep it current: the change log at the bottom records each addition and replacement, and the date the notice period started.
How you are notified, and how to object. We give at least thirty (30) days' notice before a new or replacement sub-processor begins processing your personal data, by email to the sub-processor notification contact named in your agreement and by recording it in the change log below. If you object in writing on reasonable data protection grounds within that period, we will discuss it with you in good faith and may offer an alternative configuration. If we cannot resolve it, you may terminate the affected Services without penalty and we refund prepaid fees for the terminated period pro rata. That is the sole remedy for an objection. To receive notice by email — or to ask for the contract reference for any row — write to legal@mail.thenextgencrm.com.
1. Current sub-processors
| Sub-processor | Purpose | Where it processes | Transfer mechanism |
|---|---|---|---|
| OVHcloud | Application hosting: compute, storage, network and the account databases | The region you select — United States (Virginia), European Economic Area (Frankfurt), United Kingdom (London), Canada (Montreal), Singapore or Australia (Sydney) | Within the EEA where you use the European region and under the UK Addendum for the United Kingdom region; otherwise the EU Standard Contractual Clauses |
| IDrive e2 | Encrypted backup object storage for account databases in the United States and European Economic Area regions | The region your data is hosted in — United States (Virginia), the European Economic Area (Frankfurt), and the United Kingdom, Canada and Singapore as those regions go live. Backups are held in the region your data is held in. Australian backups are held by Bunny.net in Sydney (see that row). | Not a restricted transfer where the backup storage is in your region; otherwise the EU Standard Contractual Clauses. Australian data is backed up inside Australia, by Bunny.net. |
| DeepInfra | Primary artificial-intelligence inference for text features, under contractual zero data retention | United States | EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework; and contractual zero data retention, so no data is retained after processing |
| Google Cloud (Gemini Developer API) | Secondary artificial intelligence: image understanding, document chunking and embeddings | United States | EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework |
| Telnyx | SMS, MMS and voice transmission — the messaging and voice provider we use | United States and the other countries in which the messaging and voice service operates | EU Standard Contractual Clauses |
| Mapbox | Geocoding of addresses you supply, and route optimisation | United States | EU Standard Contractual Clauses |
| Bunny.net (BunnyWay d.o.o.) | Content delivery network, media storage, DNS, video streaming and web-font delivery; and encrypted backup object storage for the Australian region | Provider established in the European Economic Area, with a global edge network and storage zones in the regions we select; Australian account-database backups are held in its Sydney storage region (Australia) | Provider established in the EEA; EU Standard Contractual Clauses where assets are served or cached outside the EEA. For Australian data the backup is held in Australia (Sydney), so it is not an overseas disclosure under APP 8 |
2. Services we operate ourselves
These parts of the platform run on infrastructure we operate in the region you select, so they are not sub-processors — they are us:
- The database engine, queue and state store, and secrets and key management.
- The global router and its regional replicas. These carry only the account record, its user accounts and the authentication data used to sign users in and decide what they can access — never the contents of your account database.
- The mail transfer agent, self-hosted, used for inbound and outbound email.
- The Android SMS and WhatsApp messaging bridge, which we operate ourselves and which transmits and briefly holds message content in order to deliver it through those channels.
3. What is not a sub-processor
Some third parties touch personal data in your account without us engaging them as sub-processors, because the relationship is yours and not ours:
- Payment providers. You connect your own account with Stripe, PayPal, GoCardless, NMI or Authorize.net under your own agreement with them. We connect to it only on your instruction. Where we process payment data as a controller — billing you for the Services, or operating your prepaid wallet — that is covered by our Privacy Policy, not the DPA.
- Integrations you enable yourself. Meta (Facebook, Instagram, WhatsApp), Slack, Telegram, Google services, YouTube, Gmail, Google Business Profile, GoHighLevel, messaging connections you add with your own credentials (for example Twilio or TextGrid), and email delivery services you connect with your own credentials such as SendGrid and Mailgun. You are the controller of anything sent to them.
- Anything you connect by webhook, API call or export.
This exclusion is substantive, not formal. Where you connect your own integration, we are not the processor or sub-processor for that processing, we give no warranty about it, and its security, retention, location and onward transfers are matters between you and that provider. Our own messaging and voice transmission runs through the providers listed in section 1 — as at the date below, that is Telnyx — together with the self-operated messaging bridge described in section 2.
Practical rule. If you send personal data outside the covered platform — by webhook, export, or a third-party integration you enable — that transfer is yours and you are responsible for it and for any contract it needs. Keep the data inside the platform, or use a provider you have covered yourself.
4. Where your data is held
We operate self-contained regional deployments. Your account database, and its backups, are held in the region you select — United States (Virginia), European Economic Area (Frankfurt), United Kingdom (London), Canada (Montreal), Singapore or Australia (Sydney). The United States, European Economic Area and Australian regions are live today; the United Kingdom, Canada and Singapore regions are rolling out, and a region becomes selectable for new accounts once its infrastructure is live. Account data is backed up within its own region in all three live regions — the United States (Virginia), the European Economic Area (Frankfurt) and Australia (Sydney). The United Kingdom, Canada and Singapore regions will follow the same in-region rule as they go live. We do not replicate account databases between regions, with one exception: a small number of features move data between regions when you ask them to — passing a contact to a sub-account in another region, escalating a support ticket to a parent account and returning the escalation state, and recording a child account's sale against a parent. Those transfers are made on your instruction and are described in clause 10.7 of the DPA.
5. Change log
Each row records a change to this list, the date the change takes effect, and the date notice was given — which must be at least thirty days earlier.
| Effective | Notice given | Change |
|---|---|---|
| 2026-10-08 | n/a — see note | Bunny.net's role expanded, and IDrive e2's narrowed. Bunny.net is now also the encrypted backup object storage for the Australian region, held in its Sydney storage region. IDrive e2 remains the backup store for the United States and the European Economic Area, and DeepInfra's row now also states its contractual zero data retention. Notice note: the Australian region has no live customer account yet, so no customer data is affected by this change; the backup target is being moved and a restore verified before an Australian customer is onboarded. |
| 2026-09-28 | n/a — see note | Mapbox added — geocoding and route optimisation for the saved-route feature for customers who use it. Added to Schedule 3 in DPA version 2.0. Notice note: because Mapbox is only used when a customer turns the route-optimisation feature on, and it was already in use before this page existed, no separate 30-day notice was given for it. Customers using saved routes are being notified directly. Future additions follow the 30-day process. |
| 2026-09-30 | 2026-09-30 | Twilio removed. We do not use a Twilio account of our own — messaging and voice run through Telnyx, which was already listed. Twilio is therefore no longer shown as a sub-processor and is now named in section 3 as an integration you may connect yourself, which is outside the DPA. This reduces the scope of the DPA; it removes no protection you had. |
| 2026-09-30 | 2026-09-30 | This page published. It restates the list already in Schedule 3 of the DPA and introduces the documented notice process and this change log. No new sub-processor began processing as a result of publishing it. |
| 2026-09-15 | 2026-09-15 | DeepInfra replaced DeepSeek as the primary text-inference provider (United States, contractual zero data retention). DeepSeek's own endpoint is switched off. |
6. Contact
Sub-processor notices, objections, contract references and data protection questions: legal@mail.thenextgencrm.com.
This page is a summary maintained for transparency and for the notice obligation in clause 7.3. It does not vary the DPA — the executed agreement governs, and where this page and Schedule 3 differ, Schedule 3 prevails.