Last updated: April 2026
Multiply uses the following third-party sub-processors to deliver our service. Each sub-processor has been evaluated for their data protection practices and, where applicable, has entered into appropriate data processing agreements with us.
| Sub-Processor | Purpose | Data Location | Data Processed |
|---|---|---|---|
| Supabase (AWS) | Database hosting and authentication | EU — Frankfurt, Germany (eu-central-1) | All application data, user accounts |
| Vercel | Application hosting and edge network | EU — Ireland | Application requests, static assets |
| Slack (Salesforce) | Campaign message delivery and engagement tracking (Slack customers) | US (with EU data processing terms and SCCs) | Campaign messages, reactions, thread replies |
| Microsoft (Bot Framework / Teams) | Campaign message delivery and engagement tracking (Teams customers) | EU / US (with Microsoft DPA and SCCs) | Campaign messages, reactions, thread replies |
| Mistral AI | AI content generation (campaign brackets, messages, diagnostics) | EU — Paris, France | Training content for campaign generation |
| Sentry | Error monitoring and diagnostics | EU — Germany | Application error reports, stack traces |
| Upstash | Rate limiting | EU — Ireland | Request metadata for rate limiting |
| Betterstack | Uptime monitoring and incident alerting | EU | Availability checks, response times |
| PostHog | Product analytics and usage tracking | EU — Frankfurt, Germany | Anonymised usage events, feature interactions |
| Resend | Transactional email delivery | US (with EU data processing terms and SCCs) | Email addresses, notification content |
| ClickUp | Internal task management for pilot and customer onboarding records | US (with EU data processing terms and SCCs) | Customer administrative contact info only; no end-user personal data |
Purpose
Database hosting and authentication
Data Location
EU — Frankfurt, Germany (eu-central-1)
Data Processed
All application data, user accounts
Purpose
Application hosting and edge network
Data Location
EU — Ireland
Data Processed
Application requests, static assets
Purpose
Campaign message delivery and engagement tracking (Slack customers)
Data Location
US (with EU data processing terms and SCCs)
Data Processed
Campaign messages, reactions, thread replies
Purpose
Campaign message delivery and engagement tracking (Teams customers)
Data Location
EU / US (with Microsoft DPA and SCCs)
Data Processed
Campaign messages, reactions, thread replies
Purpose
AI content generation (campaign brackets, messages, diagnostics)
Data Location
EU — Paris, France
Data Processed
Training content for campaign generation
Purpose
Error monitoring and diagnostics
Data Location
EU — Germany
Data Processed
Application error reports, stack traces
Purpose
Rate limiting
Data Location
EU — Ireland
Data Processed
Request metadata for rate limiting
Purpose
Uptime monitoring and incident alerting
Data Location
EU
Data Processed
Availability checks, response times
Purpose
Product analytics and usage tracking
Data Location
EU — Frankfurt, Germany
Data Processed
Anonymised usage events, feature interactions
Purpose
Transactional email delivery
Data Location
US (with EU data processing terms and SCCs)
Data Processed
Email addresses, notification content
Purpose
Internal task management for pilot and customer onboarding records
Data Location
US (with EU data processing terms and SCCs)
Data Processed
Customer administrative contact info only; no end-user personal data
We will notify customers of any changes to this sub-processor list at least thirty (30) days before a new sub-processor begins processing data. Notifications will be sent via the platform or email to account administrators.
For questions about our sub-processors or data processing practices, contact us at privacy@multiplytransfer.com.