Sub-processor List
What this list is
A sub-processor is a provider that processes personal data on CashXChain’s behalf and on our instructions, under a data processing agreement that meets Article 28 GDPR . This page lists our current sub-processors, what they do, where they process data, and the safeguards that apply to any transfer outside the European Economic Area (EEA).
Infrastructure sub-processors
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, DDoS protection, edge compute (Workers, D1, R2, KV), bot protection (Turnstile), and cookieless web analytics | United States and global edge network | EU Standard Contractual Clauses + transfer risk assessment |
| Amazon Web Services, Inc. (AWS) | Cloud hosting and storage of platform data | eu-central-1 (Frankfurt, Germany) | Processed in the EEA; SCCs where any processing occurs outside the EEA |
| Google LLC (Google Workspace) | Business email, calendar, documents and related productivity/identity services | United States and EU | EU Standard Contractual Clauses |
| Resend | Transactional email delivery (e.g. account and security notifications) | United States | EU Standard Contractual Clauses |
Social-login identity providers
If you choose to sign in with Google, Apple, Microsoft, GitHub or LinkedIn, that provider processes your data as an independent controller under its own terms during the sign-in process. These are not CashXChain sub-processors.
Mobile app distribution
Our mobile apps are distributed through Google Play (Google LLC) and the Apple App Store (Apple Inc.). Where you download or use the apps through those stores, the store operator processes data under its own terms as an independent controller.
Licensed Partners are independent controllers
The licensed institutions that perform the regulated payment, conversion, custody and settlement steps (see our Regulatory Status & Partner Disclosure) are not sub-processors. They process personal data in their own right as independent controllers, under their own regulatory and data-protection obligations.
Identity verification
Onboarding and identity verification are performed by our regulated Partners in accordance with their own KYC/KYB and AML obligations. There is no separate identity-verification sub-processor engaged by CashXChain.
International transfers
Where a sub-processor processes personal data outside the EEA, and the destination is not covered by an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses together with a transfer risk assessment and any further measures needed. This mirrors Section 7 of our Privacy Policy.
Changes
We keep this list current in our Legal Center. When we add or replace a sub-processor, we update this page and, where a data processing agreement requires it, give business customers advance notice so they may object. Questions: [email protected].