Sub-processors
Last updated August 2026. Customers on an annual agreement receive 30 days' notice before a new sub-processor begins processing customer data.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting and encrypted storage | United States, Ireland |
| Cloudflare | Edge delivery, TLS termination and DDoS protection | Global |
| Stripe | Subscription billing and payment processing | United States |
| GitHub | Repository access and pull request delivery | United States |
| Slack | Alert delivery to customer-authorised workspaces | United States |
| PagerDuty | Incident escalation for CRITICAL severity findings | United States |
| Postmark | Transactional email | United States |
Objections to a new sub-processor can be raised at legal@fortifycore.io. See also our data processing addendum and privacy policy.