Policies

Below is a list of sub-processors we work with. To learn more about adding or removing a sub-processor from the list, please email us at [email protected]

“Location” refers to the primary regions where customer data may be processed, depending on customer location, enabled features, and service configuration. TaxDome applies regional data residency controls where applicable.

Sub-processor	Purpose	Location of Sub-processor
AWS / Amazon Web Services, Inc.	Cloud infrastructure hosting, storage, compute	USA (primary), EU (EU/EEA customers)
Integromat	Infrastructure automation and workflow orchestration	Czech Republic
SitePro	General support of infrastructure	Global (including EU and USA), with regional data residency controls
Nylas	Email and calendar API integration for customer-initiated communications	Global (including EU and USA), with regional data residency controls
Gist	Email Marketing	Global (including EU and USA), with regional data residency controls
Gmail	Internal communications	Global (including EU and USA), with regional data residency controls
Stripe, Inc	Payment processor, billing	EU and USA (payment processing and compliance; regional processing determined by Stripe configuration)
AirWallex	Payment processor	Global (including EU and USA), with regional data residency controls
Google LLC / Vertex AI (Cloud)	Business analytics, login session ID, machine learning,  document processing	USA, EU (depending on feature usage and customer configuration)
Firebase (Google)	Real-time DB,  analytics	USA, EU (depending on feature usage and customer configuration)
Looker (Google / Google Cloud)	Product analytics and internal reporting (no customer tax documents),  reporting	USA, EU (depending on feature usage and customer configuration)
Meta Platforms, Inc.	Advertisement	Global (including EU and USA), with regional data residency controls
Firstpromoter	Affiliate and referral tracking	Romania
Pipedrive	Marketing, support and sales	Global (including EU and USA), with regional data residency controls
App Store	Mobile application marketplace	Global (including EU and USA), with regional data residency controls
Google Play	Mobile application marketplace	Global (including EU and USA), with regional data residency controls
ThoughtSpot, Inc.	Data analytics, BI	Global (including EU and USA), with regional data residency controls
Typeform	Support	Spain
SendGrid / Twilio (Email API)	Email delivery,  notifications	USA, EU (depending on feature usage and customer configuration)
Cloudflare, Inc	CDN,  WAF,  DDoS protection	Global (including EU and USA) via distributed CDN and security edge locations
HubSpot, Inc.	CRM, marketing automation	USA, EU (depending on feature usage and customer configuration)
Sentry.io	Application error tracking	USA, EU (depending on feature usage and customer configuration)
Datadog, Inc.	Logging, monitoring, observability	USA, EU (depending on feature usage and customer configuration)

Sub-processor engagement

TaxDome engages sub-processors to support the delivery of its services. Each sub-processor is bound by a written data processing agreement that includes confidentiality, security, and data protection obligations no less protective than those set out in the TaxDome Data Processing Agreement.

International data transfers

Where personal data is transferred outside the European Economic Area, TaxDome relies on:

• EU Standard Contractual Clauses (Commission Decision 2021/914), and/or
• EU–US Data Privacy Framework (DPF), where applicable

TaxDome conducts Transfer Impact Assessments (TIAs) and implements supplementary technical and organizational measures in line with EDPB Recommendations 01/2020.