Sub-processors
Last updated 2026-06-15
The following third-party providers process personal data on behalf of iHybrid Ltd (TeamZap) to deliver the Service. Each is bound by a Data Processing Agreement with TeamZap that mirrors our commitments to you.
Controllers are entitled to 30 days' advance notice of any addition, removal, or replacement of a sub-processor and may object on reasonable grounds — see our DPA section 6 at /legal/dpa.
| Provider | Purpose | Location | Transfer Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting (EC2, RDS, S3, CloudFront) | EU (London) primary; ap-south-1 for ops tooling | AWS DPA + SCCs for any cross-border transfer |
| Cloudflare | DNS, TLS termination, WAF | Global edge | Cloudflare DPA + SCCs |
| Google Firebase Cloud Messaging | Mobile push notification delivery | US (with EU edge) | Google Cloud DPA + SCCs |
| Twilio | SMS one-time-passcode delivery and notifications | US (with regional senders) | Twilio DPA + SCCs |
| SendGrid (Twilio) | Transactional email delivery | US | SendGrid DPA + SCCs |
| Stripe | Payment processing | EU (Ireland) for EU customers | Stripe DPA |
| Sentry | Error tracking and crash reporting | EU (Frankfurt) | Sentry DPA |
| PostHog | Product analytics (anonymised events) | EU (Frankfurt) | PostHog DPA |
| Amplitude | Product analytics (pseudonymous usage events, keyed by account id) | EU (Frankfurt) | Amplitude DPA |
| Google Analytics | One anonymous sign-up event from the account-creation pages (method only, no personal details) | Google (EU and US regions) | Google Ads Data Processing Terms + SCCs |
| Microsoft Clarity | Session recordings and heatmaps of the web app, with all text and images masked; keyed by account id | Microsoft Azure (EU and US regions) | Microsoft Products and Services DPA + SCCs |
| Amplitude | Product analytics (pseudonymous usage events, keyed by account id) | EU (Frankfurt) | Amplitude DPA |
Questions: [email protected]