Subprocessors
DoubleXL engages the following third-party subprocessors to provide the Services. Each is bound by a written agreement requiring data-protection commitments at least as protective as our own.
Last updated: June 9, 2026
Cloud infrastructure and storage
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Cloudflare, Inc. | Compute (Workers), edge caching, CDN, DDoS protection, WAF | All Customer Data in transit; cached static assets | Global edge; primary regions US, EU |
| DigitalOcean, LLC | Compute and managed services for selected workloads | Application data; logs | US |
| Neon, Inc. | Managed PostgreSQL database | Account, profile, configuration, application data | US (default), EU on request |
AI model providers
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Anthropic, PBC | Large-language-model inference (Claude) | Prompts and outputs initiated by Customer or Customer users | US |
| OpenAI, L.L.C. | Large-language-model inference (GPT family) | Prompts and outputs initiated by Customer or Customer users | US |
All AI providers are contractually bound not to use Customer Data, prompts, or outputs to train their generalized models. See the Privacy Policy §5 for details.
Communications (email, SMS, voice, WhatsApp)
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Twilio, Inc. | SMS, MMS, voice, WhatsApp Business Messaging delivery | Phone numbers, message content, call metadata, recordings | Global; primary US |
| Twilio SendGrid | Transactional and notification email delivery | Email addresses, message content, delivery metadata | US |
Identity and payments
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Stytch, Inc. | Authentication, session management, identity verification | Email, name, authentication factors, session metadata | US |
| Stripe, Inc. | Payment processing, billing, tax | Name, billing address, payment-method tokens, tax IDs | US (global processing) |
Analytics and observability
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| PostHog, Inc. | Product analytics, session replay, feature flags | Usage events, device and browser metadata, pseudonymous IDs | US / EU (region-selectable) |
| Datadog, Inc. | Application performance monitoring, RUM, log aggregation | Performance metrics, error traces, request metadata | US |
| Functional Software, Inc. (Sentry) | Error tracking and reporting | Stack traces, error context, browser and user metadata | US |
| Google LLC (Tag Manager via Cloudflare Zaraz) | Tag management for marketing analytics | Cookie identifiers, page-view metadata | US |
Customer engagement (CRM, support)
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| HubSpot, Inc. | CRM, marketing automation, lead management | Business contact information, communication history | US |
| Intercom, Inc. | In-app messaging and customer support (where enabled) | Contact information, conversation history | US |
Change notifications
We give advance notice of new subprocessors to customers with an executed Data Processing Addendum. To subscribe to subprocessor change notifications, email privacy@double-xl.com with the subject line "Subprocessor notifications" and the account email to subscribe.
Right to object
Customers with an executed DPA may object to a new subprocessor on reasonable, documented data-protection grounds. We will work in good faith to resolve the objection; if we cannot, the customer may terminate the affected Services as set out in the DPA.
Sub-subprocessors and regional providers
Some subprocessors above engage their own sub-subprocessors (for example, Cloudflare for upstream network capacity). Where required for a customer's due diligence, we will provide a fuller chain on request under NDA.
Related policies: Privacy Policy · Terms of Service · Data Processing Addendum · Security