PaytabPaytab

Legal

Sub-processors

Last updated 1 July 2026. Maintained in accordance with the Paytab Data Processing Addendum.

The following table lists the third parties ("sub-processors") that Paytab currently engages to Process Personal Data on behalf of merchants using the Paytab Service. Each entry describes what the sub-processor does, the legal entity engaged, where the Processing takes place and — where the transfer is restricted — the transfer mechanism relied upon.

Paytab evaluates every sub-processor for security, resilience and data-protection maturity before onboarding, and reviews them at least annually thereafter. We contractually flow down the obligations in our DPA — including confidentiality, security, breach notification and audit rights — and remain fully liable to merchants for any failure by a sub-processor to meet those obligations.

We will provide at least 30 days' notice of the addition or replacement of a sub-processor that Processes End Customer Data. To receive change notifications by email, subscribe below or email legal@paytab.co.uk.

Infrastructure

  • Amazon Web Services
    Amazon Web Services EMEA SARL
    Primary cloud infrastructure hosting production workloads, databases and encrypted storage.
    United Kingdom (eu-west-2), Ireland (eu-west-1)
    UK IDTA where relevant
  • Cloudflare
    Cloudflare, Inc.
    Edge network, DDoS protection, WAF and CDN for paytab.co.uk and hosted checkout.
    Global edge; primary control plane in the United States
    UK IDTA + supplementary measures
  • Supabase
    Supabase, Inc.
    Managed Postgres, authentication and realtime services underpinning the dashboard.
    United Kingdom / Ireland (customer-selected region)
    UK IDTA where relevant
  • Datadog
    Datadog, Inc.
    Application performance monitoring, log aggregation and infrastructure metrics.
    European Union (eu1.datadoghq.com)
    Not required (EEA)
  • GitHub
    GitHub, Inc.
    Source-code management and CI/CD orchestration for platform releases.
    United States
    UK IDTA
  • Sentry
    Functional Software, Inc.
    Error and exception tracking for dashboard and API surfaces.
    European Union (Frankfurt)
    Not required (EEA)

Payments & risk

  • Visa
    Visa Europe Limited
    Card scheme authorisation, clearing and settlement for Visa transactions.
    United Kingdom
    Not required (UK)
  • Mastercard
    Mastercard Europe SA
    Card scheme authorisation, clearing and settlement for Mastercard transactions.
    Belgium
    Not required (EEA)
  • American Express
    American Express Payment Services Limited
    Authorisation and settlement for American Express-branded transactions.
    United Kingdom
    Not required (UK)
  • Onfido
    Onfido Ltd
    Identity document verification and biometric checks for KYC/KYB onboarding.
    United Kingdom
    Not required (UK)
  • ComplyAdvantage
    IVXS UK Limited
    Sanctions, PEP and adverse-media screening for merchants and beneficial owners.
    United Kingdom
    Not required (UK)
  • Ravelin
    Ravelin Technology Ltd
    Machine-learning fraud detection and 3-D Secure risk scoring on card transactions.
    United Kingdom
    Not required (UK)
  • TrueLayer
    TrueLayer Limited
    Open Banking payment initiation and account information services (where enabled).
    United Kingdom
    Not required (UK)

Communications

  • Resend
    Resend, Inc.
    Delivery of transactional email (receipts, alerts, admin notifications).
    United States (eu-west routing for EEA recipients)
    UK IDTA + EU SCCs
  • Twilio
    Twilio Ireland Limited
    Delivery of SMS one-time codes and account security notifications.
    Ireland
    Not required (EEA)
  • Intercom
    Intercom R&D Unlimited Company
    In-product support chat and merchant help centre.
    Ireland
    Not required (EEA)

Business operations

  • Stripe (billing only)
    Stripe Payments UK Ltd
    Billing for Paytab's own subscription fees (not merchant payments).
    United Kingdom
    Not required (UK)
  • HubSpot
    HubSpot Ireland Limited
    Customer relationship management and sales outreach for prospects and enterprise deals.
    Ireland
    Not required (EEA)
  • Google Workspace
    Google Ireland Limited
    Corporate email, calendar and collaborative document workspace for Paytab staff.
    Ireland
    Not required (EEA)

Change notifications

Merchants who would like advance notice of sub-processor changes can subscribe to our updates mailing list. We use it only for sub-processor announcements and material DPA changes.

Subscribe to updates

Historical versions of this page and the DPA are available on request from legal@paytab.co.uk. Where a sub-processor is engaged only for regulated Paytab activities (for example, safeguarding banking partners), it may act as an independent controller and appear in our Privacy Policy rather than this list.