Sub-Processors
Last updated: July 19, 2026
1. About this list
ScoutSocial engages the following sub-processors to provide the platform. We will update this list and notify customers before engaging new sub-processors, as described in our Data Processing Agreement.
2. Current Sub-Processors
| Provider | Purpose | Data categories | Location | Transfer mechanism | DPA in place |
|---|---|---|---|---|---|
| Clerk | Authentication and identity management | Account identifiers, email, session metadata | United States | EU SCCs Module Two + UK IDTA | Yes |
| Paddle.com Market Limited (Paddle) | Merchant of record for ScoutSocial subscriptions: checkout, payment processing, tax, invoicing, refund execution, subscription management | Billing identifiers, invoice references, payment-card data (handled by Paddle, not stored by ScoutSocial) | United Kingdom | EU SCCs + UK adequacy | Yes |
| Amazon Web Services (AWS) | Cloud infrastructure, hosting, data storage (S3), content delivery (CloudFront), and transactional email (SES) | All hosted Customer data | United States / EU (Frankfurt) | EU SCCs Module Two + UK IDTA | Yes |
| OpenAI | LLM inference for content generation and pre-publish moderation when enabled | Prompts, generated outputs (identifiers redacted before transmission) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| OpenAI (Whisper) | Speech-to-text transcription of uploaded video audio | Uploaded video audio (transient; deleted after transcription) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| Anthropic | LLM inference for content generation (alternative provider) | Prompts, generated outputs (identifiers redacted before transmission) | United States | EU SCCs Module Two + EU-US DPF certification + no-training clause | Yes |
| LangChain, Inc. (LangSmith) | LLM tracing and observability when enabled. Traces may include redacted prompts and tool outputs; Connected Platform member PII is stripped by our redactor before export. Retention: 90 days. | Redacted prompts, tool traces, operational telemetry | United States | EU SCCs Module Two + UK IDTA | Yes |
| Tavily | Web search and retrieval for the agentic AI content pipeline (grounding/research queries) | Non-personal search terms/topics derived from prompts — no user Personal Data is sent | United States | N/A — no Personal Data transferred | N/A — no Personal Data |
| Google Analytics | Website and product analytics (with user consent) | Pseudonymous usage events, device metadata | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Meta Platforms (Meta Pixel) | Website advertising and conversion analytics (with user consent) | Pseudonymous usage events, device metadata, browser identifiers (_fbp) | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Google (reCAPTCHA) | Bot and abuse protection on public forms (beta signup, contact) | IP address, device/browser signals | United States / Global | EU SCCs Module Two + EU-US DPF certification | Yes |
| Google LLC / YouTube API Services | Video publishing, channel management, and performance analytics when Customers connect YouTube accounts | YouTube channel/video metadata, analytics, OAuth tokens | United States / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| LinkedIn Corporation (Microsoft) | OAuth and LinkedIn Marketing + Community Management APIs for publishing, analytics, and listening when Customers connect LinkedIn accounts | LinkedIn profile, post, analytics and Member data (subject to LinkedIn caps) | United States / EU / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| X Corp. | OAuth and X API (v2 + Account Activity) for publishing, analytics, and listening when Customers connect X accounts | X profile, post, analytics, and interaction data | United States / Global | EU SCCs Module One (C2C) + EU-US DPF certification (incl. Swiss-US, UK Extension) | Yes |
| Meta Platforms, Inc. | Facebook Login and Graph API / Instagram Graph API for publishing and analytics when Customers connect Facebook Pages or Instagram Business accounts | Page/account metadata, post content, insights, comment metadata, OAuth tokens | United States / Ireland / Global | EU SCCs Module One (C2C) + EU-US DPF certification | Yes |
| TikTok Inc. | OAuth and TikTok for Developers APIs (Content Posting, Display) for publishing and analytics when Customers connect TikTok accounts | TikTok open_id, profile, video metadata, analytics, comment metadata | United States / Singapore / Global | EU SCCs Module One (C2C); EU/UK controller is TikTok Technology Limited (Ireland) | Yes |
| Vercel, Inc. | Frontend hosting and edge delivery | Static assets, request metadata | Global (edge network) | EU SCCs Module Two + UK IDTA | Yes |
| Redis Labs (Redis Inc.) | In-memory caching and task queue | Cached session data, queued job metadata | United States | EU SCCs Module Two + UK IDTA | Yes |
| Linear Orbit, Inc. (Linear) | Issue tracking for in-app product feedback and bug reports submitted via the Send feedback form | Feedback message text, attached screenshots, submitting user and organisation identifiers, page and browser context | United States | EU SCCs Module Two + UK IDTA | Yes |
ScoutSocial does not store full payment-card details; card data is handled by Paddle.
3. Contact
Email: legal@scoutsocial.ai