CloudBridal — Subprocessor Register
Last updated: 5 June 2026
This register lists the third parties in the CloudBridal data flow. Sections A and B are Sub-processors that process personal data on CloudBridal's instructions under Article 28. By agreeing to CloudBridal's Data Processing Agreement, customers give general written authorisation for these Sub-processors; CloudBridal gives at least 30 days' notice of any change and imposes data protection obligations no less protective than its DPA. Section C lists independent third-party controllers.
For personal data of EU/UK data subjects transferred outside the EEA/UK, the transfer mechanism is the EU Standard Contractual Clauses and/or the relevant party's adequacy certification (e.g. EU-US Data Privacy Framework). Each party below publishes its own DPA or transfer safeguards.
To receive advance notice of changes to this list, email support@cloudbridal.com and we'll add you to our notification list.
A. Core sub-processors (always in the data path)
| Sub-processor | Legal entity | Purpose | Personal data categories | Region |
|---|---|---|---|---|
| Microsoft Azure | Microsoft Corporation | Hosting and infrastructure: SQL Database, Blob Storage (uploaded documents, signatures, photos), Storage Queues, Functions, Application Insights, and self-hosted Container Apps (PDF generation, GeoIP lookup) | All application personal data, uploaded documents, IP/geolocation, telemetry | US (East US 2) |
| Postmark | ActiveCampaign, LLC (Postmark) | Transactional email (receipts, invites, password resets, reminders) | Email address, name, order/appointment/payment details, one-time codes | US |
| Twilio | Twilio Inc. | SMS notifications, one-time codes, reminders | Phone number, name, message content | US |
| Sentry | Functional Software, Inc. (dba Sentry) | Error and performance monitoring (backend, Functions, frontend) | Diagnostic data (user ID, request metadata); PII scrubbing enabled to minimise personal data | US |
B. Optional / tenant-activated sub-processors
These process personal data on the tenant's instruction only where a tenant enables the integration.
| Sub-processor | Legal entity | Purpose | Personal data categories | Trigger |
|---|---|---|---|---|
| Vonage (Nexmo) | Vonage Holdings Corp. | Alternative SMS provider | Phone number, name, message content | Tenant selects Vonage as SMS provider |
| Mailchimp | The Rocket Science Group LLC (Intuit) | Email marketing and audience sync, on the tenant's instruction | Email, name, phone, contact lists | Tenant connects Mailchimp |
C. Independent controllers / third-party recipients (not sub-processors)
These parties determine the purposes and means of their own processing under their own terms and are not engaged by CloudBridal as Article 28 Sub-processors. They are listed for transparency of the data flow. Each maintains its own transfer safeguards.
| Recipient | Legal entity | Purpose | Personal data categories | Region |
|---|---|---|---|---|
| Stripe | Stripe, Inc. | Payment processing, subscription billing, payouts | Cardholder name, payment card data, billing address, transaction history, email | US / EU |
| Google LLC | reCAPTCHA, OAuth sign-in, Places address autocomplete | IP address and risk signals; (OAuth) email and profile; (Places) typed address fragments | US | |
| QuickBooks (Intuit) | Intuit Inc. | Accounting integration (tenant-activated) | Customer/vendor names, transaction line items | US |