GDPR Subcontractors List
This document lists all subcontractors that Scorable uses to process personal data on behalf of our customers in accordance with GDPR requirements.
Last updated: October 8, 2026
Subcontractors
Amazon Web Services (AWS)
- Service Provided: Cloud infrastructure and hosting services
- Data Processing Activities: Storage and processing of customer data
- Location: European Union (EU) regions
- Safeguards: AWS Standard Contractual Clauses (SCCs), AWS GDPR Data Processing Addendum
- Website: https://aws.amazon.com
- Privacy Policy: https://aws.amazon.com/privacy/
Slack
- Service Provided: Team communication and collaboration platform
- Data Processing Activities: Internal team communications
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), EU-U.S. Data Privacy Framework
- Website: https://slack.com
- Privacy Policy: https://slack.com/trust/privacy/privacy-policy
Stripe
- Service Provided: Payment processing services
- Data Processing Activities: Processing payment information and subscription management
- Location: United States, with data centers in Europe
- Safeguards: Standard Contractual Clauses (SCCs), EU-U.S. Data Privacy Framework
- Website: https://stripe.com
- Privacy Policy: https://stripe.com/privacy
Google Analytics
- Service Provided: Web analytics and reporting
- Data Processing Activities: Website usage analytics and user behavior tracking
- Location: United States, with data centers worldwide
- Safeguards: Google Cloud Data Processing Amendment, Standard Contractual Clauses (SCCs)
- Website: https://analytics.google.com
- Privacy Policy: https://policies.google.com/privacy
Google Cloud Platform
- Service Provided: Cloud infrastructure and services
- Data Processing Activities: Application hosting and data processing
- Location: European Union (EU) regions
- Safeguards: Google Cloud Data Processing Amendment, Standard Contractual Clauses (SCCs)
- Website: https://cloud.google.com
- Privacy Policy: https://cloud.google.com/privacy
Google Tag Manager
- Service Provided: Tag management system
- Data Processing Activities: Managing analytics and marketing tags
- Location: United States, with data centers worldwide
- Safeguards: Google Cloud Data Processing Amendment, Standard Contractual Clauses (SCCs)
- Website: https://tagmanager.google.com
- Privacy Policy: https://policies.google.com/privacy
PostHog
- Service Provided: Product analytics platform
- Data Processing Activities: Product usage analytics and feature tracking
- Location: European Union
- Safeguards: Standard Contractual Clauses (SCCs), GDPR-compliant data processing
- Website: https://posthog.com
- Privacy Policy: https://posthog.com/privacy
Sentry
- Service Provided: Application monitoring and error tracking
- Data Processing Activities: Error logging and performance monitoring
- Location: European Union
- Safeguards: Standard Contractual Clauses (SCCs), EU-U.S. Data Privacy Framework
- Website: https://sentry.io
- Privacy Policy: https://sentry.io/privacy/
Vanta
- Service Provided: Security and compliance automation
- Data Processing Activities: Security monitoring and compliance tracking
- Location: European Union
- Safeguards: Standard Contractual Clauses (SCCs), SOC 2 Type II certified
- Website: https://vanta.com
- Privacy Policy: https://vanta.com/privacy
Grafana Cloud
- Service Provided: Observability and monitoring platform
- Data Processing Activities: Application and infrastructure monitoring
- Location: European Union (EU) regions
- Safeguards: Standard Contractual Clauses (SCCs), GDPR-compliant data processing
- Website: https://grafana.com
- Privacy Policy: https://grafana.com/legal/privacy-policy/
Resend
- Service Provided: Transactional and marketing email delivery
- Data Processing Activities: Contact management and email communications
- Location: United States; email data processed in European Union (EU) regions
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Agreement (DPA)
- Website: https://resend.com
- Privacy Policy: https://resend.com/legal/privacy-policy
Opt-in Model Hosting Providers
The providers below are engaged only if the customer opts in for the provider via programmatic means or via Support Request.
Anthropic
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA)
- Website: https://www.anthropic.com
- Privacy Policy: https://www.anthropic.com/legal/privacy
OpenAI
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA)
- Website: https://openai.com
- Privacy Policy: https://openai.com/policies/privacy-policy
Microsoft Azure (Azure OpenAI / Azure AI Foundry)
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: Depends on the Azure deployment type of the selected model: the deployment's Azure region for regional deployments, the selected data zone (EU or US) for Data Zone deployments, or any Azure region where the model is available for Global deployments
- Safeguards: Microsoft Products and Services Data Protection Addendum, Standard Contractual Clauses (SCCs)
- Website: https://azure.microsoft.com
- Privacy Policy: https://privacy.microsoft.com/privacystatement
Fireworks AI
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA)
- Website: https://fireworks.ai
- Privacy Policy: https://fireworks.ai/privacy-policy
Groq
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA)
- Website: https://groq.com
- Privacy Policy: https://groq.com/privacy-policy
xAI
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: United States
- Safeguards: Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA)
- Website: https://x.ai
- Privacy Policy: https://x.ai/legal/privacy-policy
Mistral AI
- Service Provided: Hosted large language model (LLM) inference
- Data Processing Activities: Processing of evaluation inputs and outputs sent to models hosted by the provider
- Location: European Union
- Safeguards: Data Processing Agreement (DPA), GDPR-compliant data processing
- Website: https://mistral.ai
- Privacy Policy: https://legal.mistral.ai/terms/privacy-policy
This list will be updated as we add or remove subcontractors. Customers will be notified of any material changes to our list of subcontractors.