Notice before a material change
This list is updated when subprocessors change. Customers may object to a materially new subprocessor on documented data-protection grounds within 30 days of notice, as set out in the Data Processing Addendum.
Each subprocessor MatchAudit engages to provide, secure, maintain and support the service is named below with the purpose it serves and where it processes data. Naming the provider, the purpose and the location is the point — a category-only list cannot be assessed.
Current list
A provider appears here because it processes customer data on MatchAudit's instructions. Where a provider processes outside the EEA, the transfer mechanism is noted alongside the location.
Supabase (Supabase Pte. Ltd.)
EU/EEAStripe (Stripe Payments Europe, Ltd.)
Transfer safeguardsMicrosoft 365 / Exchange Online (Microsoft Ireland Operations Limited)
Transfer safeguardsResend (Resend, Inc.)
Transfer safeguardsCloudmersive (Cloudmersive, LLC)
Transfer safeguardsOpenAI (OpenAI Ireland Ltd.)
Transfer safeguardsGoogle Analytics (Google Ireland Limited)
Transfer safeguardsVercel (Vercel Inc.)
Transfer safeguardsFly.io (Fly.io, Inc.)
EU/EEA“SCCs” refers to the European Commission’s standard contractual clauses for the transfer of personal data to third countries. AI processing applies only where an AI-assisted feature is enabled, and is disclosed here as subprocessing rather than offered as a substitute for contractual safeguards.
Governance
A subprocessor list is only useful if changes to it are governed. These are the mechanisms that apply.
This list is updated when subprocessors change. Customers may object to a materially new subprocessor on documented data-protection grounds within 30 days of notice, as set out in the Data Processing Addendum.
Where personal data is transferred outside the EEA, MatchAudit relies on an appropriate mechanism where one is required — an adequacy decision, standard contractual clauses, or an equivalent safeguard.
Submitted IP addresses are resolved locally using cached MaxMind GeoLite2 data, and country names are resolved locally. Subject IP addresses and free-text locations are not sent to public IP or geocoding APIs.
Boundary: a subprocessor’s own certifications cover that provider’s platform. They do not certify MatchAudit. The assurance boundary is stated in full in the Trust Center.
Related disclosures
Subprocessing, contract terms and controller-side processing are maintained separately so each can be reviewed on its own.
Contract terms
Article 28 terms, the subprocessor authorisation and objection process, security measures, audits and transfers.
Open resourcePersonal data
Controller and processor roles, purposes, legal bases, retention periods and data-subject rights.
Open resourceSecurity
Access control, private storage, file intake gates, AI boundaries and the assurance boundary we state plainly.
Open resourceNeed subprocessor change notifications routed to a named contact, or a completed vendor-assessment questionnaire? State the product, the data categories in scope and the evidence your review requires.