Sub-processors
The companies that process customer data for Two Weeks Cloud on our behalf. This is a draft for legal review.
Cloud has not launched, so this list names the providers the product is built to use. Where a provider is not chosen yet, the row shows a placeholder rather than a guess. The data processing agreement refers to this page.
Sub-processors for Two Weeks Cloud
| Provider | What it does | Data it handles | Location | Status |
|---|---|---|---|---|
| Stripe | Takes payments and manages subscriptions through Stripe Checkout. | Organisation name and id, billing contact, plan and member count. Card details go to Stripe directly. | [INTERNATIONAL TRANSFER MECHANISM] | Built into Cloud billing. Cloud is not live yet. |
| [HOSTING PROVIDER] | Hosts the Cloud application, database and backups. | All customer data. | [HOSTING REGION] | Not chosen yet. |
| Postmark or Amazon SES | Delivers service emails: address verification, password reset and invitations. | Email addresses and the content of those emails. Open and link tracking is off. | [INTERNATIONAL TRANSFER MECHANISM] | Cloud supports both. In use: [MAIL PROVIDER IN USE]. |
| Sentry | Reports application errors, with personal data scrubbed before sending. | Error details and request context. | [INTERNATIONAL TRANSFER MECHANISM] | Off unless configured. For Cloud: [SENTRY ENABLED FOR CLOUD: YES OR NO]. |
| [TRACING BACKEND, IF ENABLED] | Receives OpenTelemetry traces for performance monitoring. | Request timings and identifiers. | [INTERNATIONAL TRANSFER MECHANISM] | Off unless configured. |
[LEGAL REVIEW REQUIRED] Confirm each row with the final vendor choices, add each vendor’s legal entity and location, and confirm Sentry’s scrubbing is enough to avoid it being a recipient of personal data.
This website
The marketing website and its contact and waitlist form use these providers. They apply to website visitors, not to Cloud customer data.
| Provider | What it does | Data it handles |
|---|---|---|
| [WEBSITE HOSTING PROVIDER] | Serves the website, and runs the contact and waitlist function with its key-value store. | Page requests including IP address; waitlist email addresses and consent time. |
| Postmark | Delivers contact-form messages to our team inbox. | Name, email address and message from the contact form. |
Sign-in providers
If you choose to sign in with Google, Microsoft or GitHub, that company confirms your identity to us. They are independent controllers under their own privacy policies, not our sub-processors. Jira and GitLab, if you connect them, are the customer’s own services and also not our sub-processors.
[LEGAL REVIEW REQUIRED] Confirm this classification of identity providers and connected services.
Changes to this list
We will update this page before adding or replacing a sub-processor, and tell customers as the data processing agreement sets out ([SUB-PROCESSOR CHANGE NOTICE PERIOD]).