1. How to read this register
This register identifies the core service providers used by TargetWise. A provider is a subprocessor only for the processing it performs on our behalf where we are acting as the customer’s processor. Providers supporting our own controller activities are not automatically subprocessors of every customer.
Locations below describe the provider or available processing context. They are not a promise that data stays in a single country. The applicable provider entity, hosting configuration, downstream supplier schedule and transfer documents should be read together for a procurement review.
2. Core providers
| Provider | Service and information | Role and location context |
|---|---|---|
| Cloudflare, Inc. | Application and database hosting, network security and operational logs. Customer queries and results, account identifiers and request metadata may be processed. | Processor or subprocessor for hosted information, depending on our role. Global network; US provider operations. No exclusive regional residency is promised. |
| WorkOS, Inc. | Authentication, single sign-on and identity sessions. User name, work email, identity-provider attributes and authentication events. | Identity service provider for account administration. US provider; actual processing and subprocessors are governed by its agreement. |
| Stripe contracting entity and affiliates | Hosted checkout, subscriptions, invoices and fraud prevention. Billing contact, transaction and subscription information; card credentials entered directly into Stripe. | Roles vary by activity, including independent controller duties for payment compliance. Relevant entities and locations depend on the Stripe service and customer region. |
| HubSpot, Inc. and applicable affiliates | CRM and enquiry or account follow-up. Name, business email, company, account or support context and consented acquisition labels. Enrichment results are not routinely copied to CRM. | Provider for our customer-relationship activities. Hosting region depends on the configured account and agreement; no specific region is represented here. |
3. Data sources and independent recipients
Public records and licensed professional-data suppliers are assessed according to their actual role. Some act as independent controllers or licensors. A source may receive the identifiers needed to resolve a customer query; it is not accurate to treat every source as a processor or to assume that no input leaves the application.
Where a source processes Customer Personal Data only on our instructions, it must be governed by the relevant processor terms and identified in the applicable customer schedule. Contact us for the recipient and transfer details relevant to your chosen operations and markets, or for source information relating to your own personal record.
4. Notice and objections
For changes to subprocessors handling Customer Personal Data under the DPA, we will give the account contact at least 15 days’ prior notice of an intended addition or replacement. The customer can object on reasonable documented data-protection grounds during that period. The DPA describes mitigation and termination rights if an objection cannot be resolved.
This page is updated when the relevant register changes. Contact office@targetwise.ai for a dated schedule, provider legal-entity details, transfer documents or a security questionnaire.
Email office@targetwise.ai. For privacy requests, include only the details needed to identify the relevant record.