Sub-processors
Last updated May 27, 2026
Handshapes engages the third parties listed below to process personal data on our behalf in order to provide the Services. We have a data processing agreement (DPA) in place with each sub-processor that requires them to safeguard personal data consistent with the terms of our Data Processing Agreement with our customers.
Current sub-processors
| Vendor | Purpose | Location | Agreement |
|---|---|---|---|
| Google Cloud Platform | Application hosting, Postgres, Cloud Storage, KMS, Secret Manager, OpenTelemetry monitoring | United States | DPA + BAA available |
| Stripe | Payment processing, subscription billing, invoice records | United States | DPA |
| SendGrid (Twilio) | Transactional email delivery, inbound email parse | United States | DPA |
| Twilio | SMS delivery (outbound + inbound), per-org phone numbers | United States | DPA |
| Sentry | Error monitoring, session diagnostic data for debugging | United States | DPA (BAA available on paid plans) |
| Google Maps Platform | Geocoding interpreter and venue addresses, map rendering | United States | Covered by Google Cloud DPA |
| GitHub (Microsoft) | Internal issue tracker for bug reports submitted by users | United States | DPA |
Changes to our sub-processors
We will give customers at least 30 days' advance notice before engaging a new sub-processor that will process personal data covered by our Data Processing Agreement. Notice will be provided by updating this page and (where the customer has subscribed) by email. If a customer reasonably objects to a new sub-processor on data-protection grounds, they may terminate the affected portion of the Services as described in the DPA.
Questions
To subscribe to sub-processor change notifications, or to ask a question about any vendor on this list, email legal@handshapes.com.