We keep our stack small on purpose. The full list of subprocessors is below. Name, role, jurisdiction, transfer mechanism, link to their privacy policy. Updated whenever we change a vendor. Material additions are emailed to clients with an active engagement.
Payment processing for paid engagements (when invoiced via Stripe)
Jurisdiction
Ireland
Transfer mechanism
EU-controller model
Notes
Used only for invoicing of paid engagements. Card data never touches our infrastructure (Stripe-hosted forms).
Customer-asset CDN (Emergent / hosted assets)
Role
Static image hosting (logos, marketing visuals)
Jurisdiction
Global CDN edge
Transfer mechanism
SCCs in place where applicable
Notes
Contains marketing assets only; no personal data passes through this surface.
Notifications of changes
Clients on an active engagement receive an email notification before any new subprocessor goes live. Public visitors can subscribe to the changelog (very low volume, two or three updates a year) by emailing hello@cloudvoro.com with "subscribe subprocessor changelog" in the subject.
Right to object
If a new subprocessor is materially objectionable to you (e.g. a jurisdictional concern under your own compliance regime), notify us within 30 days of the announcement. We will work with you to scope an alternative or, if neither party can reasonably accept, allow you to terminate the relevant engagement without penalty for that issue.
