Sub-processors
Last updated 14 September 2026
note
This page is Annex 3 of the Data Processing Addendum and populates Annex III of the Standard Contractual Clauses.
Under clause 7.3 of the DPA, Tessera gives organisers at least 30 days' notice before adding or replacing a sub-processor. To be notified of changes, email dpo@yourtessera.com and ask to be added to the sub-processor notification list.
| Sub-processor | Purpose | Entity location | Processing region |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, storage and compute, and transactional email delivery (SES) | USA | Singapore |
| Stripe | Payment processing, payouts, fraud prevention | Singapore / USA / Hong Kong | Global |
| PostHog | Product analytics | USA | USA |
| New Relic | Application performance monitoring | USA | EU (eu01) |
| Chatbase | Website chat assistant | USA | USA |
| Website analytics | USA | USA | |
| Postmark | Transactional email delivery | USA | USA |
| Cloudflare | Content delivery, DNS, bot management, DDoS protection and cookieless web analytics | USA | Global edge network |
| Frill | Feedback, roadmap and product-update widget in the organiser dashboard | United Kingdom | EU / UK |
| Cookiebot (Usercentrics A/S) | Consent management and storage of consent records | Denmark | EU |
Not sub-processors
Some third parties handle personal data in connection with the Services without being our sub-processors, because they are not processing on our instructions. We list them here so the distinction is clear, since it is the one enterprise procurement teams ask about most often.
- Stripe. For payment processing carried out on our instructions, Stripe is a sub-processor (see the table above). For fraud prevention and anti-fraud decisioning, Stripe acts as an independent controller in its own right, using its own risk models and its own legal basis — not on our instructions. Both roles exist side by side.
- Meta, TikTok and Google, where configured by an organiser. When an organiser connects their own advertising or analytics tag (see our Cookies Policy, section 6), the resulting relationship with that provider is the organiser's, not ours. Tessera and the organiser are joint controllers for the collection and transmission of the data (see the Privacy Policy, section 3.3), but the provider does not process on our instructions and is not a sub-processor of Tessera's.