Joryio Subprocessors
Last updated: September 23, 2026
Subprocessors handle Customer Personal Data on Joryio's behalf to deliver the Service. This list reflects the production configuration confirmed by Joryio on the date above. The providers used for a customer depend on its enabled features and delivery channels. Some providers listed separately below handle business-account information rather than customers' end-user data, or act under the customer's own agreement.
Our Data Processing Agreement explains subprocessor obligations and the process for objecting to a change. We give at least 30 days' advance notice of an intended addition or replacement through the customer's designated account contact or subscribed update contact. Subscribe by emailing [email protected] with the subject "Subprocessor updates".
1. Platform hosting and data stores
The production service's primary hosting and core databases are in Frankfurt, Germany. Cloudflare uses global edge infrastructure and its R2 storage is in its Eastern Europe hub. Delivery, support and AI processing can involve other countries; primary EU hosting is not a promise that all processing stays in the EU.
| Provider | Purpose and personal data involved | Processing location |
|---|---|---|
| Amazon Web Services | Application hosting, relational database, queues, caches, transfer storage and operational logs; account and campaign records, journey data and request metadata. CloudFront delivers static web apps. | Primary hosting and stores: Frankfurt (eu-central-1); CloudFront: global edge |
| MongoDB Atlas | End-user profiles, devices, journey execution records and outgoing message records | Frankfurt (AWS eu-central-1) |
| ClickHouse Cloud | Analytics events, aggregated reports, API request logs and, for applicable organizations, rendered message copies | Frankfurt (AWS eu-central-1) |
| Redpanda Cloud | Event streaming; events retained in the stream for seven days | Frankfurt (eu-central-1) |
| Temporal Cloud | Journey workflow state and history, including pseudonymous end-user identifiers and step data; full profiles remain in MongoDB | Workflow payloads and history: Frankfurt (eu-central-1). The US-operated control plane handles account and namespace metadata, staff logins, billing and service metrics; it does not receive workflow payloads. |
| Cloudflare | DNS, TLS, API and web traffic proxying, security filtering, login bot protection, and branded tracking/link domains; request and device information and data in transit. R2 stores exports, imports, assets and wallet passes. | Global edge; R2 storage: Eastern Europe hub |
| Sentry | Error monitoring: route and query information, filtered headers, request identifiers, and request-body field names and size. Reported payloads exclude request-body contents, cookies, user identity fields and end-user IP address fields. | EU organization; event storage in Frankfurt on Google Cloud, with 90-day retention |
Development and test environments that hold no Customer Personal Data are excluded.
2. AI features
These providers run on Joryio's accounts by default. Depending on the feature and Customer's instructions, inputs can include workspace vocabulary, campaign content, aggregated statistics and profile attributes used for personalization. AI processing is subject to the DPA.
| Provider | Purpose | Processing location |
|---|---|---|
| Anthropic | AI assistant, content generation and agents | US |
| OpenAI | AI assistant, content generation and agents | US |
| Google (Gemini) | AI assistant, content generation and agents | US / global |
| TypeSafe AI, Inc. (Jev) | AI classification and structured decision-making for supported features; request inputs and relevant context supplied to those features | US |
Jev is provided under TypeSafe's Master Customer Agreement and Data Processing Addendum. The DPA includes EU Standard Contractual Clauses for processor-to-subprocessor transfers (Module 3), where applicable, and the UK Addendum. The Master Customer Agreement requires prior customer consent for including Customer Data in model-training datasets. TypeSafe's Privacy Policy describes its general privacy practices.
Customers may instead connect their own Anthropic, OpenAI, Google Gemini, Azure OpenAI or AWS Bedrock account for supported assistant and content-generation features. Connected providers operate under the customer's own agreement to the extent they are not processing on Joryio's behalf. Customers are responsible for selecting provider plans and data-use settings appropriate for the data they submit. Do not send personal or confidential data to a provider service whose terms prohibit receiving that data.
EU processing is available through supported customer-configured AWS Bedrock (Frankfurt) or Azure OpenAI (EU region) deployments; it is not the default for Joryio-managed AI. Joryio-managed EU-only AI is planned and is not currently active.
Joryio does not train models across customers. The current integration uses individual API requests rather than provider-hosted conversation or file-storage features. Chat transcripts and assistant search indexes are stored in Joryio's own PostgreSQL database in Frankfurt; relevant earlier chat turns are included in each request. Anthropic briefly caches an instruction prefix containing assistant instructions, tool definitions and workspace configuration, but not individual chat messages or end-user records.
Providers may retain request data for abuse monitoring, safety or legal requirements under the applicable agreements. Retention depends on the provider, feature and account settings; a stateless request does not mean that the provider immediately deletes its copy. Zero-retention arrangements apply only where supported and explicitly enabled under the relevant agreement; they are not a default promise for all AI features. Joryio's processing and subprocessor obligations remain governed by the DPA.
3. Channel delivery providers
For managed channels, Joryio selects and contracts with the delivery provider as part of the customer's commercial arrangement. The customer pays Joryio, and Joryio pays the provider. These providers process Customer Personal Data on Joryio's behalf as subprocessors; any applicable provider changes follow the DPA's notice and objection process.
Where supported and agreed, we may offer customers the option to connect their own provider account or API key. A provider independently engaged under the customer's own contract operates under the customer's arrangements to the extent it is not processing on Joryio's behalf. The actual role depends on the processing and agreements, not simply whose credentials are used.
Only the provider used for a message receives the data needed for that delivery; enabling a channel does not send data to every provider listed for it.
| Channel | Providers | Personal data involved | Processing location and availability |
|---|---|---|---|
| Amazon SES, SendGrid (Twilio), Mailgun, Bird; customer-supplied SMTP servers | Recipient email address and name, message content and tracking links | Joryio-managed Amazon SES: Frankfurt; other providers: global. SMTP servers are independently supplied by the customer, and Joryio operates no SMTP relay | |
| SMS | Apifon, Simasti Technologies Ltd., Twilio, Vonage, Bird / MessageBird, Amazon SNS | Recipient phone number, message content and short links | Apifon: Greece (EU); Simasti: data storage in Germany (Google Cloud and MongoDB); delivery and access locations may vary. Other providers: global |
| Meta (WhatsApp Cloud API), Twilio, Infobip | Recipient phone number, message content and media | Global | |
| Viber | Apifon | Recipient phone number and message content | Greece (EU); Joryio-managed |
| Mobile push | Apple (APNs), Google (FCM) | Device tokens and notification payloads | Global; sent using the customer's app credentials, with Joryio providing the transport |
| Browser push | Google, Mozilla, Apple | Browser subscription endpoints and notification payloads | Global; Joryio sends directly to the push endpoint registered by the browser, without another managed push intermediary |
| Wallet passes | Apple Wallet, Google Wallet | Pass fields and device registration information | Global; used when a customer issues passes |
4. Business-account and app operations providers
The following providers also support the Service. Their processing may involve Account Data governed by the Privacy Policy, rather than Customer Personal Data governed by the DPA. Their role depends on the relevant activity and agreement.
| Provider | Purpose and data | Processing location |
|---|---|---|
| SendGrid (Twilio) | Joryio system emails, such as invitations, password resets and notifications; recipient address, name and message | US |
| Stripe | Subscription and wallet payments; billing contact and card details entered on Stripe's hosted form. Joryio stores payment references and invoice records, not full card details. | Global; EU customers served by Stripe's Irish entity |
| Google Fonts | Font delivery for the web app, admin console and documentation; visitor IP address and request information | Global |
5. Customer-connected systems and marketing website
Customer-connected Shopify, WooCommerce and Magento stores, warehouses and webhook endpoints are the customer's systems or independently engaged services. We exchange data with these systems on the customer's instructions; connecting them does not automatically make them Joryio subprocessors.
Marketing-site hosting, CRM, enquiry notifications, analytics and advertising are separate from the processing of customers' end-user data in the Service. Their recipient categories, purposes and international processing are described in the Privacy Policy and Cookie Policy.