Who processes your data
Fortoxa uses a small set of third parties to deliver the service. Each entry below covers what they do, what they see and where they operate.
Fortoxa maintains a subprocessor list for services used to deliver the platform. Vendor details and applicable processing information are provided through official customer materials and agreements where applicable.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Stripe | Billing, subscription management, payment processing | Customer email, billing address, payment method (Stripe-hosted) | EU / UK / US |
| Resend | Transactional email delivery (alerts, compliance reports, onboarding) | Customer email, message content | EU |
| Primary database provider | Platform data persistence for customer, workspace and evidence records | Customer workspace records and evidence metadata | EU / UK |
| Queue / caching provider | Asynchronous workflow support, rate limiting and temporary caching | Operational queue metadata and short-lived cache data | EU / UK |
| Evidence storage provider | Evidence artefact storage and report delivery | Compliance reports, exported evidence | EU / UK |
| Cloud hosting provider | Hosting public application and customer-facing platform services | Platform operational metadata | EU / UK |
Subscribe to subprocessor changes
Paid customers are notified by email at least 30 days before any new subprocessor begins processing customer data. To subscribe for notifications without a paid plan, contact our team.