Sub-Processors
Effective Date: January 1, 2026 | Last Revised: May 12, 2026 | Version 1.1
Overview
Infrastructure & Hosting
Payment Processing
Communications & Support
Analytics & Monitoring
Security & Compliance
Fulfillment & Logistics
About this Sub-Processors. This Policy covers the rules, obligations, and rights that apply to this policy on the Upmos marketplace. Read the full text below; by using our Services you agree to comply with it.
In Plain English (Non-Binding Summary)
1. Overview. Upmos uses carefully selected third-party service providers (“sub-processors”) to deliver our marketplace platform and related services. Each sub-processor has been evaluated for their data protection practices, security
This plain-language box is provided for accessibility and readability only. It is not a substitute for the full Policy below, which controls in case of any conflict.
Print, Export & Relevant Links
Table of Contents
1. Overview
Upmos uses carefully selected third-party service providers (“sub-processors”) to deliver our marketplace platform and related services. Each sub-processor has been evaluated for their data protection practices, security certifications, and compliance with applicable privacy laws including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and other relevant frameworks.
All sub-processors are bound by contractual obligations that require them to:
- Process personal data only on Upmos’s documented instructions
- Implement appropriate technical and organizational security measures
- Assist Upmos in fulfilling data subject rights requests
- Delete or return personal data upon termination of services
- Submit to audits and inspections as required
2. Infrastructure & Hosting
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, compute, storage, and CDN | All platform data including seller accounts, product listings, order data | United States (South Central US) |
| Cloudflare | DNS, DDoS protection, WAF, CDN | IP addresses, HTTP request metadata, cached content | Global (edge network) |
| Azure SQL Database | Primary relational database | Seller profiles, product data, order records, financial data | United States |
| Azure Blob Storage | File and media storage | Product images, seller documents, compliance records | United States |
3. Payment Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe | Payment processing, seller payouts | Payment card details, bank account info, transaction data, KYC documents | United States |
| PayPal | Alternative payment method | Email addresses, transaction amounts, buyer/seller identifiers | United States |
| Plaid | Bank account verification | Bank account numbers, routing numbers, account holder names | United States |
PCI-DSS Compliance: All payment sub-processors are PCI-DSS Level 1 certified. Upmos does not store, process, or transmit cardholder data directly — all payment processing is handled by our certified payment partners.
4. Communications & Support
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| SendGrid (Twilio) | Transactional email delivery | Email addresses, email content, delivery metadata | United States |
| Twilio | SMS notifications & 2FA | Phone numbers, SMS content, delivery status | United States |
| Zendesk | Customer and seller support ticketing | Names, email addresses, support ticket content | United States |
5. Analytics & Monitoring
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics | Website analytics & traffic analysis | Anonymized IP addresses, page views, session data, device information | United States |
| Azure Application Insights | Application performance monitoring | Error logs, performance telemetry, anonymized usage data | United States |
| Hotjar | UX heatmaps & session recordings | Anonymized click/scroll behavior, device type (PII excluded) | EU (Malta) |
6. Security & Compliance
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| DocuSign | Electronic signature for agreements | Names, email addresses, IP addresses, signed documents | United States |
| Persona | Identity verification (KYC/AML) | Government-issued IDs, selfie photos, verification results | United States |
| Microsoft Entra ID | Identity & access management | User credentials, authentication tokens, access logs | United States |
7. Fulfillment & Logistics (GoCargo)
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| UPS | Package shipping & tracking | Recipient names, shipping addresses, package dimensions/weight, tracking numbers | United States & International |
| USPS | Package shipping & tracking | Recipient names, shipping addresses, tracking numbers | United States |
| FedEx | Package shipping & tracking | Recipient names, shipping addresses, package details, tracking numbers | United States & International |
| ShipStation | Shipping label generation & order management | Order details, shipping addresses, carrier selection | United States |
