This list reflects our current sub-processors. The authoritative list is maintained as part of the DPA, available on request.
Current subprocessors
| Subprocessor | Purpose | Region |
|---|---|---|
| Cloudflare, Inc. | EU edge hosting, compute, and storage — Workers, Durable Objects, D1 (EU region), KV, and Queues. The platform my-iris runs on. | EU data plane (account metadata US) · EU–US DPF + SCCs |
| Twilio Inc. | Voice calls and SMS delivery (the carrier gateway that places calls and sends text messages, such as end reports and verification codes), and transactional email — signup verification codes (OTP) — via Twilio SendGrid. | US, with EU edge · EU–US DPF + SCCs |
| Apple (Apple Push Notification service) | Delivers push notifications to the my-iris app on iPhone. It receives only an encrypted, fixed-length reference and the app’s push address — never the alert text or a phone number. | Global push service · Apple states that its transfers from the EEA are governed by SCCs |
| Google (Firebase Cloud Messaging) | Delivers push notifications to the my-iris app in Chrome on Android. It receives only an encrypted, fixed-length reference and the app’s push address — never the alert text or a phone number. | Global push service · Google LLC: EU–US DPF |
Cloudflare, Inc.
EUEU edge hosting, compute, and storage — Workers, Durable Objects, D1 (EU region), KV, and Queues. The platform my-iris runs on.
EU data plane (account metadata US) · EU–US DPF + SCCs
Twilio Inc.
Transfer safeguardsVoice calls and SMS delivery (the carrier gateway that places calls and sends text messages, such as end reports and verification codes), and transactional email — signup verification codes (OTP) — via Twilio SendGrid.
US, with EU edge · EU–US DPF + SCCs
Apple (Apple Push Notification service)
Transfer safeguardsDelivers push notifications to the my-iris app on iPhone. It receives only an encrypted, fixed-length reference and the app’s push address — never the alert text or a phone number.
Global push service · Apple states that its transfers from the EEA are governed by SCCs
Google (Firebase Cloud Messaging)
Transfer safeguardsDelivers push notifications to the my-iris app in Chrome on Android. It receives only an encrypted, fixed-length reference and the app’s push address — never the alert text or a phone number.
Global push service · Google LLC: EU–US DPF
Conditional sub-processors. Apple and Google process data only for a workspace that uses the my-iris app; a workspace that alerts by SMS and phone call sends them nothing. If a backup voice or SMS carrier is enabled for your workspace, its provider — Telnyx or Vonage — is engaged as a sub-processor for that traffic only, and it is added to this list when it is engaged. Today, Twilio carries all voice and SMS traffic.
Change-notice mechanism
When we add or replace a subprocessor, we update this page, publish a notice in your my-iris console and e-mail everyone on the notification list, no later than when the new subprocessor starts processing your data. You then have 30 days to object on reasonable data-protection grounds. If we can’t resolve an objection, for example by a change to the service or to your configuration, you can end the affected part of the service. A change that has to take effect at once, for security, legal or service-continuity reasons, is published as soon as we can, and the 30 days run from then. The details are in the DPA, which is available on request.
Subscribe to changes
Customers can subscribe to subprocessor change notifications. Email hello@my-iris.io to be added to the notification list, and we will alert you whenever this list changes.