Sub-processor List
SureCart Inc. (“SureCart”) uses the third-party sub-processors listed below to provide the SureCart platform.
Core Infrastructure sub-processors are always engaged as part of the service. Customer-Configured services are engaged only when the Customer connects them. SureCart will update this page and give notice of material changes under Section 5.2 of the Data Processing Agreement.
Ecommerce platform · Processor: SureCart Inc. · Application servers: United States
Core Infrastructure
| Sub-processor | Service | Location |
|---|---|---|
| Amazon Web Services, Inc. | Relational database (RDS), object storage (S3), content delivery (CloudFront), serverless compute (Lambda) and message queues (SQS). Customer and End Customer data at rest | USA |
| Fly.io, Inc. | Application hosting for the SureCart API, dashboard, checkout and customer portal | USA |
| Cloudflare, Inc. | DNS, TLS termination, content delivery, WAF and DDoS protection; End Customer checkout and portal traffic transits Cloudflare’s edge | Global Anycast (headquartered in USA) |
Shipping, Tax and Documents
| Sub-processor | Service | Location |
|---|---|---|
| Popout, Inc. d/b/a Shippo | Shipping rate calculation and label generation; processes recipient name, shipping address, phone and parcel details | USA |
| TPS Unlimited, Inc. d/b/a TaxJar (a Stripe company) | US sales tax calculation; processes shipping address and order line items | USA |
| Urlbox Ltd (URL Box) | Server-side PDF generation of receipts and invoices; processes End Customer name, address and order details shown on the document | United Kingdom |
Email and Content Moderation
| Sub-processor | Service | Location |
|---|---|---|
| AC PM, LLC (Postmark, an ActiveCampaign company) | Transactional email delivery: receipts, order and subscription notices, customer-portal login links | USA |
| OpenAI, LLC | Content moderation of merchant-customisable email templates | USA |
Monitoring and Analytics
| Sub-processor | Service | Location |
|---|---|---|
| AppSignal B.V. | Performance telemetry and error tracking; request context may incidentally contain End Customer data | Netherlands (EU) |
| Functional Software, Inc. d/b/a Sentry | Error logging and crash reports; stack traces may incidentally contain End Customer data | USA (Iowa) or EU (Frankfurt) |
| Better Stack, Inc. (Better Uptime) | Uptime monitoring and alerting | USA |
| Google LLC (Google Analytics 4) | Usage analytics for the merchant dashboard; processes Customer staff usage events | USA |
Group Services
| Sub-processor | Service | Location |
|---|---|---|
| Brainstorm Force US LLC (SureContact) | CRM and email for SureCart’s communications with Customers | USA |
Customer-Configured Payment Processors
SureCart is not a payment processor. These processors are engaged only when the Customer connects its own account, and each acts under its own agreement with the Customer; SureCart passes payment data to them on the Customer’s instruction. Card numbers and security codes are entered directly into the processor’s fields and never reach SureCart’s servers.
| Provider | Service | Location |
|---|---|---|
| Stripe, Inc. / Stripe Payments Europe, Limited / Stripe Payments UK Limited | Card, wallet and bank payments | USA / Ireland (EU) / United Kingdom |
| PayPal, Inc. / PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal and card payments | USA / Luxembourg (EU) |
| Mollie B.V. / Mollie UK Ltd | Card and local European payment methods | Netherlands (EU) / United Kingdom |
| Razorpay Payments Private Limited | Card, UPI and local Indian payment methods | India |
| Paystack Payments Limited and local Paystack entities | Card and local African payment methods | Nigeria, Kenya, South Africa |
Customer-Configured Integrations
Engaged only at the Customer’s explicit instruction. SureCart acts solely as a technical conduit; the destination is selected and controlled by the Customer.
| Provider | Service | Location |
|---|---|---|
| Integration partners (email marketing, CRM, LMS, membership and automation tools) | End Customer and order data sent to tools the Customer connects | Determined by the Customer’s provider |
| Customer-configured webhook endpoints | Order, customer, subscription and affiliate event payloads sent to URLs the Customer configures | Customer-controlled |
| Customer’s WordPress site (SureCart plugin sync) | Store data synced to the Customer’s own WordPress installation | Customer-controlled |
Note: surecart.com website analytics and advertising (Google Analytics 4 on surecart.com, Google Tag Manager server-side container, Microsoft Clarity, Cloudflare Web Analytics, Meta Pixel and Conversions API, Google Ads), site assets (Google Fonts, Bunny Fonts, ShortPixel, Gravatar, Google reCAPTCHA) and optional SureCart Analytics plugin data are controller activities. They are covered by the SureCart Privacy Policy and Cookie Policy, not this list.
Transfer safeguards: where a sub-processor is outside the European Economic Area, including all those in the United States, SureCart ensures appropriate safeguards are in place before transferring Controller Data. These include the EU Standard Contractual Clauses (Module 3, Decision (EU) 2021/914) or the recipient’s certification under the EU-U.S. Data Privacy Framework.
Changes to this list: SureCart may update this list from time to time and will give notice of material changes under the Data Processing Agreement.
SureCart Inc. · 26 October 2026
