Subprocessor Registry
NormaTrack engages selected third-party service providers ("Subprocessors") that are authorized to process personal data on NormaTrack's behalf in the course of delivering the platform. This registry identifies each Subprocessor, describes its processing role, and specifies the geographic location of data processing.
Last updated: March 30, 2026
Not all Subprocessors listed in this registry process personal data for every customer account. The personal data processed by each Subprocessor depends on the features and services used by the relevant customer.
Our Commitment
All Subprocessors are subject to security and privacy assessments prior to onboarding. NormaTrack enters into Data Processing Agreements (DPAs) with each Subprocessor, as required under GDPR Article 28. Where personal data is transferred outside the EU/EEA, NormaTrack implements Standard Contractual Clauses (SCCs) in accordance with Commission Implementing Decision (EU) 2021/914 to ensure an adequate level of data protection.
Infrastructure & Hosting
The following Subprocessors provide the underlying cloud infrastructure used to host application code, route network traffic, and store persistent data.
| Subprocessor | Purpose | Processing Location |
|---|---|---|
| Vercel Inc. | Hosting of application code and delivery of edge-cached content to end users. | Global Edge / EU Core |
| Cloudflare Inc. | DNS resolution, Web Application Firewall (WAF), and DDoS mitigation. | Global |
| Amazon Web Services (AWS) | Primary relational database hosting, persistent data storage, and managed authentication services. | EU Region (Frankfurt / Paris) |
Core Operations & Telemetry
The following Subprocessors are used strictly for monitoring application health, diagnosing errors, and reporting on system performance.
| Subprocessor | Purpose | Processing Location |
|---|---|---|
| Sentry (Functional Software, Inc.) | Application error tracking and performance monitoring. Stack traces are anonymized prior to transmission and are used solely for diagnostic purposes. | USA / EU |
Communications
The following Subprocessors are used strictly for the delivery of transactional notifications to platform users.
| Subprocessor | Purpose | Processing Location |
|---|---|---|
| SendGrid (Twilio Inc.) | Delivery of transactional email notifications (e.g., account verification, password reset, team invitations). | USA |
Subscribe to Updates
In accordance with GDPR Article 28(2), NormaTrack provides data controllers with advance notice of any intended changes to this Subprocessor registry, including the addition of new Subprocessors or material changes to existing ones.
Customers may request to receive 30-day advance notice of such changes by contacting privacy@normatrack.com. NormaTrack will provide notification via email to the designated contact on record for the relevant customer account.
Governing Law
This Subprocessor Registry is governed by and construed in accordance with the laws of France, without regard to conflict of law principles. Any dispute arising out of or in connection with this registry shall be subject to the exclusive jurisdiction of the competent courts of Paris, France.