Sub-processors
Last updated: 2026-04-30 · Effective: [pending counsel sign-off]
A "sub-processor" is a third-party vendor that processes personal information on Teraplex's instructions in support of our site and CRM. Each is engaged under a written data-processing agreement (DPA) that includes the European Standard Contractual Clauses where the engagement involves cross-border transfer.
We will provide at least 30 days' advance notice before adding a new sub-processor that handles personal information, by updating this page. To receive notifications of changes, write to privacy@teraplex.us; we will add you to a low-volume notification list.
Sub-processor list
| Vendor (legal entity) | Purpose | Hosting region | Data categories | DPA / certs |
|---|---|---|---|---|
| Vercel Inc. | Static-site hosting and edge delivery | United States (AWS) | IP, request metadata, server logs | DPA · SOC 2 Type II |
| Cloudflare, Inc. | CDN, WAF, bot management, DDoS protection | Global edge; primary US | IP, request metadata, threat scoring | DPA · SOC 2 Type II, ISO 27001 |
| HubSpot, Inc. | Customer relationship management, marketing automation, form processing | United States (us1, AWS) | Name, work email, company, role, phone, project context, free-text submissions | DPA · SOC 2 Type II, ISO 27001/27018 |
| Twilio Inc. | Voice (sales calls, call routing) | United States | Phone number, call metadata | DPA · SOC 2 Type II, ISO 27001 |
| ActiveCampaign LLC (Postmark) | Transactional email (form receipts, password-style flows) | United States | Email address, message content | DPA · SOC 2 Type II |
| Sinch Email (Mailgun) — verify final selection | Marketing email delivery (where not handled by HubSpot) | United States | Email address, message content, engagement events | DPA · SOC 2 Type II |
| Clearbit, Inc. (HubSpot company) | Firmographic enrichment of B2B work-email contacts | United States | Work email, derived employer attributes | DPA · SOC 2 Type II |
| Twilio Segment Inc. | Customer-data-platform event routing | United States | Event payloads, identifiers, IP | DPA · SOC 2 Type II |
| Plausible Insights OÜ | Privacy-first, cookieless aggregate analytics | European Union (Estonia / Germany) | Aggregated, non-identifying interaction data; no IP retained at rest | DPA · ISO 27001 in progress · cross-border: SCCs |
| Heap, Inc. | Product analytics — calculator, form-field, scroll depth | United States | Event payloads, pseudonymous identifier, IP | DPA · SOC 2 Type II |
| Osano, Inc. (verify selected vendor) | Cookie-consent banner, consent record, DSAR intake support | United States | Consent record, IP, geo | DPA · SOC 2 Type II |
| Intuition Machines, Inc. (hCaptcha) | Bot protection on forms | United States / European Union | IP, browser fingerprint signals, challenge response | DPA · SOC 2 Type II |
Notification list
To receive 30-day-notice email updates when this list changes, write to privacy@teraplex.us with subject "sub-processor notification list."