This list reflects our current sub-processors. The authoritative list is maintained as part of the DPA, available on request.
Legal
Subprocessors
The third parties MeshWorks Wireless Oy (Finland) engages to process data on behalf of IRIS customers. We keep this set small and deliberate.
Last updated: 7 June 2026
Current subprocessors
Cloudflare, Inc.
EUEU edge hosting, compute, and storage — Workers, Durable Objects, D1 (EU region), KV, and Queues. The platform IRIS runs on.
EU data plane (account metadata US) · EU–US DPF + SCCs
Twilio Inc.
EUSMS and voice/IVR delivery (the carrier gateway that sends alert messages and places calls), and transactional email — signup verification codes (OTP) — via Twilio SendGrid.
US, with EU edge · EU–US DPF + SCCs
Conditional sub-processors. If you enable an optional channel, its provider is engaged as a sub-processor for that traffic only — Telnyx or Vonage (additional SMS/voice), Slack, or Telegram. These are added with advance notice under the DPA before any data flows to them. SMS and Voice (via Twilio) are the only channels live today.
Change-notice mechanism
Before we add or replace a subprocessor, we update this page and notify customers in advance — measured from the date the notice email is dispatched — so you have an opportunity to review and object. A shorter-notice carve-out applies for urgent changes required for security, legal, or service-continuity reasons, with your objection right preserved. The exact notice period and objection process are set out in the DPA, which is in legal sign-off.
Subscribe to changes
Customers can subscribe to subprocessor change notifications. Email [email protected] to be added to the notification list, and we will alert you whenever this list changes.