Alpaco Subprocessor List
Transparency regarding third-party vendors and data processors that support Alpaco
Last Updated: July 6, 2026
To support the delivery of our platform and features, Alpaco ApS engages third-party service providers as subprocessors. These entities may have access to or process personal data on behalf of our customers.
We conduct rigorous technical, security, and privacy reviews of all subprocessors and require them to adhere to strict Data Processing Agreements (DPAs) in compliance with the GDPR.
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| DigitalOcean, LLC | Core cloud hosting, databases, and system logs. | All application data at rest (user accounts, campaign data, workspace logs). | Germany (Frankfurt) | DigitalOcean DPA + EU Standard Contractual Clauses (SCCs) |
| Amazon Web Services EMEA SARL | File and asset storage (S3). | Uploaded creative image assets, template attachments, and exports. | Sweden (Stockholm) | AWS GDPR DPA + EU Standard Contractual Clauses (SCCs) |
| Cloudflare, Inc. | CDN, DNS, edge computing, object storage, image optimization | IP addresses, request metadata, and TLS session data. | Global Network (EU Data Localization active) | Cloudflare DPA + EU Standard Contractual Clauses (SCCs) |
| Mailgun Technologies, Inc. | Transactional mail transport for system alerts and notifications. | Recipient and sender email addresses, subject lines, and event logs. | European Union (Mailgun EU) | Mailgun DPA + EU Standard Contractual Clauses (SCCs) |
| WorkOS, Inc. | User authentication, single sign-on (SSO) identity management, and secure MCP remote connector verification. | User identifiers, email addresses, login timestamps, and session tokens. | United States | WorkOS DPA + EU Standard Contractual Clauses (SCCs) |
| Mixpanel, Inc. | Product analytics and user behavior tracking to monitor platform performance and feature usage. | User IDs, feature interaction events, account tiers, device types, and IP addresses. | United States | Mixpanel DPA + EU-US Data Privacy Framework(SCCs) |
| OpenAI Ireland Ltd. | AI content generation and text analysis for Alfred Insights. | Session-specific prompt payloads (email snippets, brief parameters). Zero-retention API. | Ireland (EU Controller) / US (Inference) | OpenAI DPA + EU Standard Contractual Clauses (SCCs) |
| Jina AI GmbH | Web scraping when users provide a URL brief for the AI to analyze. | Targeted URLs submitted by the user and resulting page content. | Germany (Berlin) | Jina AI DPA + Intra-EEA processing |
Subprocessor Updates
If you wish to receive automated notifications whenever we modify or add a new subprocessor to this list, please send an email to privacy@alpaco.email with the subject line "Subscribe to Subprocessor Updates."