Sub-processors
We use the following service providers to process Customer Personal Data on behalf of merchants using EPR One. We require confidentiality and security commitments from each sub-processor.
| Vendor | Role | Region(s) used |
|---|---|---|
| Google Cloud (Server-side Tag Manager) | Server-side tag routing for marketing site analytics/ads (first-party endpoint at sgtm.epr-one.com) | EU (Netherlands, eu-west4) |
| Salesforce Heroku (incl. Heroku Postgres/Redis) | App hosting & DB | EU (Ireland/Frankfurt) |
| Amazon Web Services (S3) | Object storage (exports, backups) | EU (Ireland/Frankfurt) |
| New Relic | Centralised logs/metrics | EU region |
| Sentry | Error monitoring | EU region (Frankfurt) |
| Insurer-appointed incident-only providers | Incident response and legal support (activated only during security incidents) | EU/UK/US/AU (as needed; transfers via SCCs/UK Addendum; full provider names available to customers on request) |
| Proton (Proton Mail) | Email hosting (support@epr-one.com) | Switzerland and Germany |
| Help Scout | Help desk / support ticketing and optional chat (merchant contact data & support content only) | United States |
| OpenAI | AI assistance for support and debugging (translation, summarisation, drafting) | United States (transfers via SCCs/UK Addendum) |
| Google (Translate/Gemini) | Translation and AI assistance for support | EU/United States (transfers via SCCs/UK Addendum) |
Change-notice policy
We will provide at least 30 days' notice for material changes to this list. If you reasonably object to a change, please contact support@epr-one.com; if unresolved, you may terminate the impacted service pro-rata. For insurer‑appointed, incident‑only providers activated during a security incident, prior notice may not be practicable; these are pre‑authorised in our DPA and we will update this page promptly thereafter. Full provider names are available to customers on request.
Note: Our marketing site on Vercel does not process Customer Personal Data on your behalf. See our Privacy Policy and DPA for details.