360REV — Sub-processors
Effective 2026-10-19
This is the current list of sub-processors that 360REV engages to process customer personal data. We'll notify customers of material changes via in-app banner + email at least 30 days before adding a new sub-processor.
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon | Postgres database hosting | AWS us-east-1 |
| Cloudflare R2 | Subscriber file storage | global edge |
| Google Cloud (GCP) | Compute: the platform (us-central1); hosted websites and the self-hosted Matomo analytics (us-east1) | us-central1, us-east1 |
| Stripe | Payment processing + subscription billing | US/EU |
| Brevo | Transactional email + subscriber-managed sending | EU |
| Twilio | Voice + SMS carrier (default; subscribers may BYOT) | US/EU/global |
| Anthropic | LLM inference (platform-managed) | US |
| OpenAI | AI picture generation (ChatGPT Business): the AI image generator, Auto-share pictures and blog pictures | US |
| Pexels | Stock photo search in the post composer (search words only) | Canada/US |
| Other LLM providers | LLM inference — only where a subscriber configures their own provider key (bring-your-own-key) | Varies by provider |
| Keycloak (self-hosted) | Identity + authentication | us-central1 (with 360REV) |
How we govern sub-processors
- Every sub-processor is bound by a written agreement that includes GDPR-compliant data protection obligations
- We conduct a vendor risk assessment before onboarding
- We monitor sub-processor compliance annually
- EU/UK transfers use SCCs (Standard Contractual Clauses) per the DPA at /legal/dpa-template
Object to a sub-processor
If you have a reasonable objection to a new sub-processor, contact privacy@360rev.com within 30 days of notice. We'll work with you on alternatives.
List last reviewed 2026-10-19. This page is the canonical source.