Version 2.2 | Last updated: 03 June 2026
This page lists sub-processors engaged by Yabie AB to process personal data on behalf of merchants under the Yabie Data Processing Agreement (DPA). All sub-processors are bound by written data processing agreements and reviewed periodically. Where data is transferred outside the EEA or UK, a lawful transfer mechanism is in place. To object to a sub-processor, contact privacy@yabie.com with the subject line “Sub-processor objection”. Yabie will notify merchants at least 30 days before any addition or removal takes effect.
| Sub-Processor | Category | Purpose | Location | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services | Infrastructure | Primary cloud hosting, storage, and compute infrastructure for the Yabie platform. | EU | EEA hosted |
| MongoDB Atlas | Infrastructure | Production database storing merchant and end-customer personal data. | EU | EEA hosted |
| Datadog | Infrastructure | Infrastructure and application performance monitoring; system and application logs which may include IP addresses, user identifiers, and request metadata relating to merchant platform usage. | EU / USA | SCCs |
| Vercel | Infrastructure | Hosting and delivery of customer-facing web applications; personal data transits this platform. | EU (functions) / Global CDN | SCCs |
| WSO2 | Identity & Access | Identity provider and API gateway handling merchant authentication and platform API requests. | EU | EEA hosted |
| WorkOS | Identity & Access | Identity provider and API gateway handling merchant authentication and platform API requests. | USA | SCCs |
| Sinch | Communications | SMS and email delivery to merchant end-customers (e.g. receipts, loyalty messages). | Sweden / USA | SCCs |
| Google LLC (Google Analytics) | Analytics | Included for transparency only. Yabie acts as data controller for product usage analytics. See Privacy Policy for details. | USA | SCCs |
Transfer basis: EEA hosted = no international transfer. SCCs = EU Standard Contractual Clauses (Commission Decision 2021/914), supplemented by UK Addendum where applicable.
This list covers sub-processors acting on behalf of Yabie’s merchants (where the merchant is the data controller). It does not cover tools used solely for Yabie’s own internal operations, third parties engaged directly by the merchant, or Yabie’s own analytics processing (governed by the Privacy Policy). Google LLC (Google Analytics) is listed above for transparency as it involves transfers of merchant representative data to the USA.
| Date | Type | Detail |
|---|---|---|
| 03 Jun 2026 | Updated | v2.2: Datadog purpose description updated. |
| 30 Mar 2026 | Updated | v2.1: List revised to confirmed DPA-scope sub-processors. |
| 01 Oct 2024 | Added | Initial publication. |
Yabie AB, 559083-2092, Sweden · privacy@yabie.com · dsar@yabie.com · IMY (imy.se) · ICO (ico.org.uk)