Sub-Processors and Affiliates
Last updated: September, 2026
TrustArc utilizes the following third-party data processors (“Sub-processors”) for the provision and operation of its Solutions and processing of Customer Data, including any associated Personal Information therein.
Data Hosting Location
| Entity Name |
Location |
Purpose |
Transfer Mechanism |
Sub-Processor Contact |
| Amazon Web Services |
Data Center for Platform: US US-East-1 (Fairfax, Virginia) or EU-Central-1 (Frankfurt) Data Center for Nymity Products: Canada-Central-1 (Ontario, Canada) Data Center for Cookie Consent Manager: EU-West-1 (Dublin, Ireland) |
Hosting service for TrustArc platform |
DPF and SCCs |
https://aws.amazon.com/contact-us/ |
Third Party Sub-Processors
| Entity Name |
Location |
Purpose |
Transfer Mechanism |
Sub-Processor Contact |
| Amazon Web Services | US-East-1 (Fairfax, Virginia) or EU-West-1 (Dublin, Ireland) | Web search for AI-enabled features (Amazon Bedrock AgentCore) | DPF and SCCs | https://aws.amazon.com/contact-us/ |
| Daytona Platforms, Inc. | US or EU | Secure sandbox environment for executing isolated AI-generated code and processing tasks | SCCs | https://www.daytona.io/contact |
| Google LLC |
US or EU | Image generation for AI-enabled features (Gemini); bot protection on consen and individual rights request forms (reCAPTCHA) |
SCCs | https://cloud.google.com/contact |
| LangChain Inc. |
US-Central1 (Iowa, US) or EU-West4 (Netherlands) |
Monitoring and tracing of AI-enabled feature activity within a TrustArc-controlled workspace |
SCCs | https://support.langchain.com |
| Mailjet SAS (a Sinch company) |
Frankfurt, Germany, Saint- Ghislain, Belgium |
Nymity R&A (Research & Alerts) email delivery service |
SCCs |
https://www.mailjet.com/contact/support/ |
| Microsoft Corporation |
EU Region for AI processing for EU-hosted customers and Canada, Central (Toronto, ON) for Nymity R&A |
Cloud services supporting application logging and messaging queue capabilities for e-mail delivery for Nymity R&A |
DPF and SCCs |
https://support.microsoft.com/en-us/contactus |
| MongoDB Atlas |
US or EU | Embedding generation, semantic search and reranking supporting AI-enabled features |
DPF and SCCs | https://www.mongodb.com/company/contact |
| OpenAI, Inc. |
US. [For Customers who elect EU data residency, OpenAI-based, AI-enabled features are served from Microsoft Azure’s AI Platform within the EU (see Microsoft Corporation above)] |
Large language models supporting AI-enabled features |
SCCs | privacy@openai.com |
| Pinecone Systems, Inc. |
US East-1 (Fairfax, Virginia) or EU Central-1 (Frankfurt) |
Vector database storing embeddings used by AI- enabled features |
SCCs | https://www.pinecone.io/contact/ |
| Salesforce.com |
California, USA |
Customer service, sales, and support |
DPF, SCC and BCR |
https://www.salesforce.com/company/contact-us/ |
| Workato, Inc. |
Virginia, US or Frankfurt, Germany |
TrustArc platform integration tool |
SCC |
https://support.workato.com/en/support/home |
Changes to Sub-processors
TrustArc may remove, replace or appoint suitable and reliable Sub-processors in accordance with the Data Processing Addendum (“DPA”) available here. TrustArc shall inform you of any new Sub-processors by updating its Sub-Processor disclosure and providing email notification no less than thirty (30) days before authorizing such Sub-processor(s) to Process Personal Information in connection with the provision of the applicable Solutions. To enable receipt of such e-mail notifications, you may subscribe here.
TrustArc Affiliates
In addition to the Sub-processors above, TrustArc may utilize the affiliates listed in the TrustArc Affiliate Sub-processor disclosure available here.
Data Transfers
Where TrustArc transfers personal data in connection with its Solutions, it does so in compliance with applicable data protection laws and regulations and utilizes the following safeguards and framework, as applicable:
- Standard Contractual Clauses (or “Model Clauses”)
- EU-U.S. Data Privacy Framework (“DPF”), UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF
Data Processing Addendum
TrustArc offers a comprehensive global DPA, which is designed to meet the requirements of applicable data privacy laws and regulations. Our DPA is available here.
Technical and Organizational Measures
TrustArc’s Technical and Organizational Measures (“TOMs”) that describe the security safeguards and other relevant measures implemented by TrustArc, such as access controls, transmission controls, data backup, and logical separation, can be found here.