Subprocessors

Everyone who can touch the data.

A short list, deliberately. Every entry here is a party we would have to tell you about anyway — so it is easier to publish it.

Subprocessor	What it does	Data it can see
Application hosting	Runs the ewent application and stores event, registration and checklist records.	All operational data
Email infrastructure	Delivers transactional event mail and reports bounces and complaints.	Recipient address, name, message content
CDN & DNS	Serves the public site and terminates TLS.	Request metadata only — IP, user-agent
Live room provider (Dium)	Hosts the live session where an event uses one, and returns a join signal.	Attendee identity for the events that use it
Identity provider (Werify)	Single sign-on for organizer and staff accounts.	Staff identity — never attendee data

Being specific. Named vendors, regions and the transfer mechanism for each are in the signed subprocessor schedule that accompanies the DPA — we keep the commercial detail there rather than on a public page. Ask and we will send it.

How changes work

We give notice before adding or replacing a subprocessor.
Controllers may object; if we can’t resolve it, you can terminate without penalty.
Every subprocessor is bound by terms no less protective than our own.
This page is updated when the list changes, not quarterly in arrears.

Want to be told when this page changes? Ask to be on the notification list.