Legal
Subprocessors
Last updated: 2026-05-17
The approved third parties to whom we may pass your data as part of operating the product. Each is bound by a Data Processing Agreement (DPA) and committed to a protection level equivalent to what is described in our privacy policy and privacy posture.
We notify customers of new subprocessors at least 30 days in advance via the email registered with their account. Add this page to your procurement team's watch-list if you need formal tracking.
A note on Amargi Hub
Reach and every other Amargi product use a shared identity provider called Amargi Hub for sign-in. Hub is an internal authentication service operated by Amargi Creative — same legal entity, same hosting, same compliance perimeter — and therefore NOT a subprocessor. Hub does not store any WhatsApp message content, contact lists, or any data governed by Meta's BSP terms. Full breakdown in our privacy posture §1.
Active subprocessors
| Name | Purpose | Location | When engaged | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Primary compute + storage hosting (Postgres, application servers, object storage). | Germany (Frankfurt) | Always engaged for EU-resident tenants (the default). | Link ↗ |
| Amazon Web Services, Inc. | Backup hosting in alternate regions + cross-region encrypted backups + AWS Secrets Manager for the envelope-encryption master key (when Reach:Secrets:Mode=aws). | Per-tenant region selection (defaults to eu-central-1) | Always engaged for backups; for primary hosting only when the tenant selects an AWS region at onboarding. | Link ↗ |
| Google LLC (Google Cloud) | Alternate backup hosting + GCP Secret Manager for envelope-encryption master key (when Reach:Secrets:Mode=gcp). | Per-tenant region selection | Only when the tenant selects GCP at onboarding. | Link ↗ |
| Cloudflare, Inc. | CDN + DDoS mitigation + edge TLS termination for marketing surfaces. Does not see customer message bodies (which are served from origin behind authenticated app routes, not cached). | Global edge (US-headquartered) | Always engaged for the marketing site + asset edge cache. | Link ↗ |
| Anthropic PBC | Large-language-model inference for Agents and AI auto-replies. Anthropic is contractually bound not to use customer prompts or responses to train its models (Anthropic Commercial Terms of Service). | United States | Only when a customer triggers an Agent run or an AI auto-reply fires. | Link ↗ |
| Stripe, Inc. | Payment processing + invoice issuance + tax computation. Card numbers, CVCs, and expiry dates never touch Amargi servers (Stripe Elements tokenization). | Ireland (EU customers) + United States | Always engaged for paid plans. | Link ↗ |
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. | WhatsApp Business Platform (Cloud API), Messenger Platform, Instagram Graph API. The channel provider for messages our customers send and receive through Meta-owned surfaces. | Ireland (EU customers) + United States | Engaged when the customer connects a WABA, a Facebook Page, or an Instagram Business account. | Link ↗ |
| 360dialog GmbH | WhatsApp Business Solution Partner for phone-number provisioning and message-tier billing (where Amargi is not yet a verified Tech Provider in a specific region). | Germany (Berlin) | Only for tenants in regions where Amargi routes through 360dialog instead of the direct Cloud API; opt-in at onboarding. | Link ↗ |
| Resend, Inc. (or customer-selected email provider) | Transactional email delivery (sign-up confirmation, password reset, invoice notifications). Customers may bring their own SMTP / SendGrid / Mailgun for tenant-side email. | United States (Resend); customer-chosen for tenant-side | Always engaged for platform-side email; customer-selected providers are engaged only when the tenant configures them. | Link ↗ |
Cross-border transfers
Several listed subprocessors are based in the United States. For transfers outside the EEA we rely on the EU Standard Contractual Clauses (2021 issue) and equivalent transfer mechanisms (UK IDTA, etc.). EU-only region pinning is available on enterprise plans.
Contact
Questions about this list, or subprocessor-change notifications: contact@amargicreative.com.
Disclaimer: this is a template suitable for Meta App Review and early launch. Before serving regulated sectors, a privacy lawyer in your jurisdiction must review it.