Sub-Processor List
Version 2.0, effective Oct 23, 2026
Published at https://apisec.ai/subprocessors. Incorporated by reference into the APIsec Master Subscription Agreement. On written request APIsec will provide a dated PDF of the version in effect on an Order Form’s Effective Date. This list supersedes the Subprocessors Summary dated August 17, 2023.
1. Scope
A “Sub-Processor” is a third party engaged by APIsec that processes Service Data, including Personal Data within Service Data, on Customer’s behalf in the course of providing the Services. Capitalized terms not defined here have the meaning given in the APIsec Master Subscription Agreement (the “MSA”) and the APIsec Data Processing Agreement.
This page lists:
- Section 3, infrastructure and platform Sub-Processors that host or process Service Data, including Evidence Data as defined in Section 6.6 of the MSA.
- Section 4, Sub-Processors that process Customer account and contact Personal Data but do not access Service Data.
- Section 5, vendors APIsec uses that are not Sub-Processors, listed for transparency, because they process no Customer Personal Data.
The distinction matters: the notice and objection rights in Section 2 apply to Sections 3 and 4 only.
2. Notice, Subscription, and Objection
These provisions implement Section 6.9 of the MSA.
Advance notice. APIsec will give notice of any new or replacement Sub-Processor at least thirty (30) days before that Sub-Processor begins processing Service Data, by updating this page and sending email to Customer’s designated privacy or security contact.
Subscription. Customers may subscribe to automatic notification of changes to this page at https://apisec.ai/subprocessors/subscribe, or by emailing privacy@apisec.ai with the subject line “Subscribe: Sub-Processor notifications” and the name and address of the contact to be notified.
Objection. If Customer reasonably objects to a new Sub-Processor on documented data protection or security grounds within fifteen (15) days of notice, APIsec will not permit that Sub-Processor to process Customer’s Service Data pending resolution, and the Parties will work in good faith toward a commercially reasonable alternative. If no alternative is agreed within thirty (30) days of the objection, Customer may terminate the affected Order Form on written notice and receive a pro-rata refund of prepaid Fees for the unused remainder of the then-current Term.
Emergency replacement. Where APIsec must replace a Sub-Processor on shorter notice to maintain the security or availability of the Services, APIsec will give notice as soon as practicable and the objection right in this Section applies from the date of that notice.
3. Infrastructure and Platform Sub-Processors
These Sub-Processors host or process Service Data. Unless an Order Form specifies otherwise, Service Data is hosted in the United States in accordance with Section 6.8 of the MSA.
| Sub-Processor | Entity and location | Processing activity | Personal Data categories | Service Data | Evidence Data |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | United States | Primary cloud infrastructure: compute, storage, and database hosting for the Services | Any Personal Data within Service Data; Authorized User account data | Yes | [CONFIRM] |
4. Account and Communications Sub-Processors
These Sub-Processors process Personal Data relating to Customer’s Authorized Users and business contacts. They do not access Service Data.
| Sub-Processor | Entity and location | Processing activity | Personal Data categories |
|---|---|---|---|
| HubSpot, Inc. | United States | CRM, support ticketing, and customer communications | Name, business email, telephone, job title, support correspondence |
| Twilio Inc. (SendGrid) | United States | Transactional and notification email delivery | Name, business email, message content |
| Google LLC (Google Workspace) | United States | Business email and document collaboration, including support correspondence | Name, business email, correspondence content |
| Zoom Communications, Inc. | United States | Video meetings and, where enabled, recordings and transcripts | Name, business email, meeting audio, video, and transcripts |
| Docusign, Inc. | United States | Electronic signature of agreements | Name, business email, signature, IP address |
| Tabs, Inc | United States | Subscription management and billing | Name, business email, billing contact and account details |
5. Vendors That Are Not Sub-Processors
APIsec uses the following vendors in operating its business. They do not process Service Data or Customer Personal Data, and the notice and objection rights in Section 2 do not apply to them. They are listed for transparency.
| Vendor | Use | Why it is not a Sub-Processor |
|---|---|---|
| Slack Technologies | Internal team collaboration | APIsec policy prohibits transmitting Service Data or Evidence Data through Slack. See item 16(g) of the Security Exhibit. |
| Notion Labs, Inc. | Internal knowledge base and documentation | No Customer Personal Data or Service Data is stored in Notion. |
| GitHub, Inc. | Source code repository | APIsec source code only. No Customer Personal Data or Service Data. |
| Postman, Inc. | Internal API development and testing | APIsec’s own APIs and synthetic test data only. |
6. International Transfers
Service Data is hosted in the United States unless an Order Form specifies otherwise. Where a Sub-Processor accesses Service Data from outside the United States, or where APIsec transfers Personal Data subject to the GDPR, UK GDPR, or Swiss FADP to a country without an adequacy decision, that transfer is made under the Standard Contractual Clauses or other transfer mechanism described in the APIsec Data Processing Agreement.
APIsec personnel and the Sub-Processors listed in Section 3 may access Service Data remotely from other jurisdictions solely to provide support, maintenance, and security monitoring, subject to those safeguards
7. Sub-Processor Diligence
Before engaging any Sub-Processor with access to Service Data, APIsec performs a documented security and privacy assessment and imposes contractual obligations at least as protective as those in the Security Exhibit and Section 5 of the MSA. APIsec reassesses material Sub-Processors at least annually and remains responsible for their acts and omissions as if performing directly.
8. Version History
| Version | Effective | Change |
|---|---|---|
| 2.0 | Oct 23, 2026 | Full revision. Added data categories, Service Data and Evidence Data columns, notice and objection mechanics, subscription method, transfer safeguards, non-sub-processor disclosures, and version history. Supersedes the Subprocessors Summary of August 17, 2023. |
| 1.0 | 17 August 2023 | Initial list. |
Superseded versions are retained and available on written request to privacy@apisec.ai.
9. Contact
Questions about this list, objections under Section 2, and requests for superseded versions: privacy@apisec.ai.