Sub processors

Updated: 12 Mar 2024

Required
Name	Description	Data type	Location	Certification & Compliance	Transfer Mechanisms	DPA	Privacy Policy	Data retention	More
Heroku owned bySalesforce	Cloud hosting provider where we have our databases.	Everything	Ireland	ISO 27001 ISO 27017 ISO 27018 SOC 1 SOC 2 SOC 3	EU-U.S. Data Privacy Framework	Show		∞	Read more
Salesforce and the invalidation of EU-US Privacy Shield Heroku Trust and Compliance Documentation
Amazon Web Services (AWS)	AWS is the backbone of Heroku where we store our databases, exports, backups etc.	Everything	Sweden & Ireland	ISO 27001 ISO 27017 ISO 27018 ISO 27701 SOC 1 SOC 2 SOC 3	EU-U.S. Data Privacy Framework	Show		∞	Read more
AWS Service Terms Customer update: AWS and the EU-US Privacy Shield
Optional
Name	Description	Data type	Location	Certification & Compliance	Transfer Mechanisms	DPA	Privacy Policy	Data retention	More
Swish owned byDanske Bank, Handelsbanken, Länsförsäkringar, Nordea, SEB and Swedbank and Sparbankerna	Payment provider for tickets.	Payment info	EU/EES mainly*		GDPR		Show	∞
46elks	SMS provider.	SMS, Phone numbers	Sweden		GDPR		Show	90 days	Read more
Data protection GDPR general
Rule	Email provider for transactional and campaign emails.	Emails	Sweden		GDPR	Show	Show	30 days
Stripe	Payment provider for tickets.	Credit Cards and Payment info	USA	PCI Level 1 SOC 1 SOC 2	EU-U.S. Data Privacy Framework	Show	Show	∞	Read more
Stripe Privacy Center (answers how Stripe handle the Privacy Shield invalidation)
SendGrid owned byTwilio	Email provider for transactional and campaign emails.	Emails	USA	PCI DSS Level 4 SOC 2	EU-U.S. Data Privacy Framework	Show	Show	30 days	Read more
How the Recent Privacy Shield Ruling Impacts Twilio SendGrid Users Ensuring Continuity in EU-U.S. Data Transfers for Twilio Customers
Mandrill owned byMailchimp, Intuit	Email provider for transactional and campaign emails.	Emails	USA	ISO 27001 SOC 2 SOC 3	EU-U.S. Data Privacy Framework	Show	Show	30 days	Read more
Ensuring Compliance with EU Data Protection Laws (Privacy Shield invalidation)
Vonage owned byEricsson	Livestream video & chats provider.	Livestream chat names, Livestream video	USA	SOC 2 HIPAA	EU-U.S. Data Privacy Framework	Show	Show	20 days	Read more
Vonage GDPR overview

* I undantagsfall kan överföring av personuppgifter till tredje land ske via Getswish underleverantörer. Vid sådana överföringar säkerställer Getswish att lämpliga skyddsåtgärder har vidtagits enligt reglerna i dataskyddsförordningen.