Sub-Processors
This page lists all sub-processors used by Tuurio ID in the delivery of our service, pursuant to Art. 28 para. 2 GDPR. Tuurio notifies customers at least 30 days before adding a new sub-processor.
Current sub-processors
| # | Company | Location | Purpose | Data processed | DPA |
|---|---|---|---|---|---|
| 1 | Google Cloud Platform (Google Ireland Ltd.) | Ireland (EU) / Frankfurt, DE (eu-west3) | Hosting, database (Cloud SQL PostgreSQL), compute, backup | All service data: user accounts, tenants, tokens, audit logs, vault data | Yes (Google Cloud DPA) |
| 2 | Paddle.com Market Limited | London, United Kingdom | Payment processing, invoicing, tax compliance as Merchant of Record | Payment data, billing addresses, email addresses (account holders) | Yes (Paddle DPA) |
| 3 | PostHog Inc. | EU (cloud hosting) | Product analytics (usage statistics, feature adoption) | Anonymized usage data, no PII (cookieless default) | Yes (PostHog DPA, EU hosting) |
| 4 | Uptime Robot Service Provider Ltd. | Turkey / USA | External availability monitoring, public status page | URL monitoring (no personal data) | Not required (no PII processing) |
Change notification process
Tuurio notifies customers at least 30 days before adding a new sub-processor by email and/or dashboard notification. Customers may object within 14 days for important data protection reasons. If no objection is received, the change is deemed approved.
Version 3.0, March 9, 2026