ScaleBridger maintains an Authorized Subprocessor Register — provided to clients as a Data Processing Agreement annex and on request, with notice of changes and a genuine right to object. This page explains how the Register works and how to obtain it.
ScaleBridger maintains an Authorized Subprocessor Register — the definitive list of the third parties it may engage to process personal data on a client’s behalf, each recorded with its legal name, processing purpose, applicable services, primary processing region, and the date it was added. The Register is provided to clients as an annex to the Data Processing Agreement, is available to clients on request at any time, and is shared with qualified prospective clients during diligence.
The Register is intentionally not published on this page. Publishing a vendor roster is not required by data-protection law; what the law requires — and what ScaleBridger provides — is authorization, ready access to the current list for every client, notice of changes, and a genuine opportunity to object.
Not every sub-processor is used for every client. The sub-processors applicable to an engagement depend on the Services, architecture, and accounts identified in the applicable Order Form or SOW, and the client’s copy of the Register identifies which entries apply.
Many engagements also run on platforms and accounts that the client itself owns or is required to hold — its own CRM, payment processor, hosting, booking, or property-management accounts. Those are the client’s own arrangements under the providers’ own terms and are not sub-processors engaged by ScaleBridger. Likewise, vendors ScaleBridger uses for its own business operations — website analytics, ScaleBridger’s own billing and payment collection, domain management, and general correspondence — process data with ScaleBridger acting as the controller and are disclosed in the Privacy Policy and Cookie Policy.
Current and prospective clients can obtain the Authorized Subprocessor Register at any time through the contact method on the ScaleBridger website or their Order Form. Clients receive it as a Data Processing Agreement annex at signature and may request the current version whenever they need it. Qualified prospective clients receive it during diligence, before any personal data is processed.
ScaleBridger engages each sub-processor to process personal data only as needed to provide the Services and on terms that, in substance, are no less protective than those in our Data Processing Agreement, to the extent applicable to the sub-processor’s role. ScaleBridger remains responsible to the client for a sub-processor’s performance of its data-protection obligations.
When ScaleBridger adds or replaces a sub-processor that processes personal data on a client’s behalf, it updates the Register and, where required by applicable data-protection law, provides affected clients with notice of the change and a reasonable opportunity to object before the new sub-processor processes their data, as described in the Data Processing Agreement.
ScaleBridger’s sub-processors process personal data primarily in the United States, and each Register entry states its primary processing region. Where personal data originating from a jurisdiction with cross-border transfer requirements is involved, ScaleBridger and the client put in place an appropriate transfer mechanism as described in the Data Processing Agreement.
Requests for the Register and questions about this page can be sent through the contact method on the ScaleBridger website or your Order Form. ScaleBridger, Austin, Texas, United States.
This page is a v0.3 document pending counsel review. The Authorized Subprocessor Register itself is provided as a Data Processing Agreement annex and on request; vendors used for ScaleBridger's own operations are disclosed in the Privacy and Cookie Policies. Where ScaleBridger processes personal data on a client's behalf, the DPA controls.