Third-party services that process data as part of ForgeStop's NFC authentication platform, and the third parties ForgeStop uses to run its own business.
ForgeStop provides 15 days advance written notice before engaging any new Sub-processor (Table A). Clients may object within 15 days on reasonable data protection grounds. To subscribe to notifications, contact help@forgestop.com.
Changes to Table B are published here and in the DPA but do not trigger the 15-day notice or objection right, because those providers do not process client personal data on the client's behalf (DPA Section 3.4 and Section 6.5).
The following third-party services are currently authorised to process client personal data in connection with ForgeStop's platform. All are subject to data protection obligations no less protective than ForgeStop's Data Processing Agreement, whether through a negotiated agreement or acceptance of the provider's standard data processing terms.
| Sub-processor | Location | Processing Activities | Assurance |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure: compute (App Runner), relational database (RDS PostgreSQL), object storage (S3), secrets management (Secrets Manager), identity and access management (Cognito), content delivery (CloudFront), web application firewall (WAF), encryption key management (KMS), monitoring (CloudWatch, CloudTrail). | SOC 2 Type II, ISO 27001, PCI DSS, FIPS 140-2 Level 3 (KMS) |
| MongoDB Atlas | United States | NoSQL database for analytics data and audit logs. VPC-peered to ForgeStop AWS infrastructure: all traffic over private network, no public internet. Point-in-time recovery with 35-day snapshot retention. | SOC 2 Type II, ISO 27001 |
| New Relic | United States | Application performance monitoring (APM). Receives application telemetry, error tracking, and performance metrics. No client personal data transmitted. | SOC 2 Type II, ISO 27001 |
| Mapbox | United States | Geospatial visualization for scan location analytics on the Dashboard. Receives anonymised scan coordinate data for map rendering. | SOC 2 Type II |
| IPStack / PositionStack | Austria / United States | Geolocation API services for scan location resolution. Receives IP-derived approximate location data during authentication events. | Privacy policy available |
| Google reCAPTCHA | United States | Bot protection for product authentication pages. Receives browser interaction signals for bot detection. No personal data shared. | Google SOC 2 Type II, ISO 27001 |
| Regional Implementation Partners | Per Statement of Work | On-site Batchmaker device installation, NFC production line integration, and initial configuration at client facilities. | NDA + ForgeStop subcontractor security approval |
Disclosed for transparency under DPA Section 3.4. ForgeStop is the data controller of the records these providers hold. Personal data of client personnel appears in them incidentally (a name on an invoice, an email in a project record, a voice on a recorded call). These providers are ForgeStop's own processors under written contracts; they are not Sub-processors, and the DPA's notice, objection and audit provisions do not apply to them.
| Third party | Location | Purpose and data held | Assurance |
|---|---|---|---|
| Microsoft Corporation | United States / EU | Business productivity and collaboration: email (Outlook), messaging (Teams), document storage (SharePoint, OneDrive) including per-client document spaces, and identity/SSO (Entra ID). Holds client personnel contact details, correspondence, and client-supplied documents. | SOC 2 Type II, ISO 27001, EU Data Boundary options |
| Atlassian | United States / EU | Project and knowledge management (Jira, Confluence). Holds service delivery records, meeting notes, and work items which may reference client personnel by name and email. | SOC 2 Type II, ISO 27001 |
| Krisp Technologies | United States only | Meeting recording, transcription, and note generation. Holds voice recordings and transcript content of client representatives participating in recorded meetings. No regional data residency option; EEA-origin transfers are made by ForgeStop as controller under Standard Contractual Clauses (DPA Section 8.2A). | SOC 2 Type II; HIPAA BAA available |
| Granola | United States only | Meeting transcription and note generation. Audio is deleted after transcription; holds transcript content and notes of client representatives participating in recorded meetings. No regional data residency option; EEA-origin transfers as for Krisp (DPA Section 8.2A). | Security documentation available on request |
| Anthropic PBC | United States | AI-assisted generation of meeting notes and internal work items from transcripts, per DPA Section 5.1(g). Processes transcript content which may include client personnel names and statements. Organisational account only; commercial terms apply; no training on customer content. | SOC 2 Type II, ISO 27001, ISO/IEC 42001 |
| HubSpot | United States / EU | Customer relationship management. Holds client personnel contact details and commercial relationship records. | SOC 2 Type II |
| Zoho Corporation | India / United States | Accounting and financial records (Zoho Books) and agreement execution (Zoho Sign). Holds client billing contact details and signatory details. Zoho CRM and WorkDrive are not used; ForgeStop's CRM of record is HubSpot. | SOC 2 Type II, ISO 27001 |
| Stripe Inc. | United States | Payment processing for ForgeStop's subscription billing. Holds client billing contact details. Tokenised: ForgeStop does not receive or store raw card data. | PCI DSS Level 1 |
| GitHub | United States | Source code management and CI/CD. Does not process client personal data in the ordinary course. Listed for completeness as part of the service delivery toolchain. | SOC 2 Type II, ISO 27001 |
Platform data (consumer scan events, product records, batch data and Dashboard user accounts) resides on ForgeStop-controlled infrastructure: RDS PostgreSQL (primary database) and MongoDB Atlas (analytics and audit, VPC-peered, private network only). New Relic receives application telemetry only. Mapbox receives anonymised scan coordinates. IPStack/PositionStack receive IP-derived approximate location during authentication. Regional implementation partners have physical access to Batchmaker hardware during installation only.
Client relationship data (the names, email addresses, correspondence, documents and, where meetings are recorded, voice and transcript content of client personnel) is processed by the business-administration providers in Table B. ForgeStop is the controller of those records. None of the Table B providers receives platform scan data or consumer personal data. Stripe and Zoho process ForgeStop's own billing and signatory data.
ForgeStop's primary hosting region is us-east-1 (US East, N. Virginia), with disaster recovery replication to us-west-2 (US West, Oregon). Microsoft, Atlassian and HubSpot offer EU processing options. Krisp and Granola process and store data in the United States only and offer no regional residency; transfers of EEA-origin personal data to them are made by ForgeStop as controller under Standard Contractual Clauses (DPA Section 8.2A). Specific region information is available upon request. Data residency in other regions may be available as a custom enterprise arrangement.
AWS, MongoDB Atlas, New Relic, Mapbox, IPStack/PositionStack and Google reCAPTCHA are standard platform-level services used across all client engagements. They are disclosed in this list and in the DPA (Annex 2, Table A) at contract signing. Per DPA Section 6.2, they are exempt from the 15-day per-engagement client notification requirement. Regional Implementation Partners and any future Sub-processor with direct client personal data access require notification.
| Date | Change |
|---|---|
| March 2026 | Initial publication. Four sub-processors: AWS, Stripe, Zoho, Regional Implementation Partners. |
| March 2026 (v1.1) | Expanded per CTO review: added MongoDB Atlas, New Relic, Mapbox, IPStack/PositionStack, Google reCAPTCHA. AWS details expanded. Total: 9 sub-processors. |
| September 2026 (v1.2) | Disclosure correction: Microsoft, Atlassian, Krisp, Anthropic and HubSpot added, all in use before v1.1 was published and not previously disclosed. GitHub added for completeness. Zoho narrowed to Books and Sign (CRM migrated to HubSpot). Notes rewritten to distinguish platform data from client relationship data; residency note added for Krisp. Total: 15 entries. |
| October 2026 (v1.3) | Restructured into two tables. Table A (7 Sub-processors): AWS, MongoDB Atlas, New Relic, Mapbox, IPStack/PositionStack, Google reCAPTCHA, Regional Implementation Partners. Table B (9 business-administration providers, ForgeStop as controller): Microsoft, Atlassian, Krisp, Granola, Anthropic, HubSpot, Zoho, Stripe, GitHub. Granola added. No provider removed. Exemption note narrowed to Table A. |
← Back to Legal · Data Processing Agreement · Version 1.3 · Last updated: October 2026
.png)
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}