This page lists all third-party sub-processors used by ValidatePIIClasses.com to process personal data on behalf of our customers (data controllers). This list is maintained as an annex to our Data Processing Agreement.
Certifications shown under Vendor Safeguards are each vendor's own certifications, not VPC's.
Infrastructure Sub-Processors
| Provider | Purpose | Data Processed | Location | Vendor Safeguards |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting, database, file storage, CDN, cache, container registry, secrets management | All tenant data (encrypted at rest and in transit) | United States | SOC 2 Type II, ISO 27001, GDPR DPA, CSA STAR |
Breach-Data Sub-Processors
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| District 4 Labs | Breach-data lookup | Email, name, address, phone, SSN, and other identity fields (varies by search type) | United States |
We will update this list before adding a new breach-data provider.
Operational Sub-Processors
| Provider | Purpose | Data Processed | Location | Vendor Safeguards |
|---|---|---|---|---|
| Amazon SES | Transactional email (account verification, password reset, notifications) | User email addresses, message content | United States | SOC 2, ISO 27001 (covered under AWS DPA) |
| Sentry (Functional Software Inc.) | Application error monitoring and performance tracking | De-identified error logs; may include request metadata (IP, user agent) | United States | SOC 2 Type II, GDPR DPA, data scrubbing configured |
Sub-Processor Change Notification
Per our Data Processing Agreement, we will notify customers at least 30 days before engaging a new sub-processor or making a material change to an existing one. Notifications are sent to the primary contact email on file for each customer account.
Customers may object to a new sub-processor within 14 days of notification. We will work in good faith to address objections, which may include offering an alternative processing arrangement or allowing the customer to terminate the affected services without penalty.
Change Log
| Date | Change |
|---|---|
| October 2026 | Removed breach-data providers no longer in use |
| March 2026 | Initial publication |
Contact
For questions about our sub-processors:
Privacy: privacy@validatepiiclasses.com
Security: security@validatepiiclasses.com