Sub-processors
These are the companies that handle personal data for Amana. For the records your company keeps in Amana, they're sub-processors under our data processing agreement; for accounts and billing, they're our processors. Several are used only if your company turns the feature on. Last updated 13 October 2026.
We give at least 30 days' notice by email to account owners before adding a sub-processor.
| Name | What it does | Data | Location | When used |
|---|---|---|---|---|
| Amazon Web Services | Hosting, file storage, email sending (SES), sign-in (Cognito), phone calls (Chime), texts (End User Messaging) and delivery (CloudFront) | All Amana data | UK (London); CloudFront edge locations worldwide | Always |
| MongoDB Atlas | The database | All Amana data | Ireland (on AWS) | Always |
| Stripe | Subscription billing | Billing contact and payment details (card details go to Stripe directly, never to us) | US and Ireland | Always, for paying customers |
| Gmail and Google Calendar sync, Google sign-in, Google Ads lead forms | Content of connected mailboxes and calendars; name and email address for sign-in; lead form answers | US and worldwide | Only if your company connects Google | |
| Microsoft | Outlook and Microsoft 365 mail and calendar sync | Content of connected mailboxes and calendars | US and worldwide | Only if your company connects Microsoft |
| Meta | WhatsApp Business messages; Facebook and Instagram lead ads | Message content and numbers; lead form answers | US and worldwide | Only if your company connects WhatsApp or lead ads |
| Xero | Turning accepted quotes into invoices | Client company names and email addresses, invoice lines | New Zealand, Australia and US | Only if your company connects Xero |
| Companies House | UK company lookups | The company names and numbers searched | UK | When someone looks a company up |
| postcodes.io | UK postcode lookups | Only the postcode searched | UK | When someone looks a postcode up |
| Morph by Vereon | Migrate & connect: imports, and two-way sync with other systems | The records being imported or synced | UK and EU (on AWS) | Only if your company turns the add-on on |
Services that receive no personal data
- Open Exchange Rates (US) provides currency exchange rates. Amana only asks it for the latest rates. If it can't be reached, the rates come from ExchangeRate-API's open feed or the European Central Bank, in the same way.
- Browser push services (run by Apple, Google and Mozilla) deliver the notifications people turn on. The content is encrypted so that they can't read it.
Services your company chooses
Your company can send data to places of its own choosing: its own webhooks and API clients, Slack, Teams or Discord, and the systems it connects through Migrate & connect (such as HubSpot or Salesforce). Those aren't our sub-processors: they receive what your company sends them, under your company's own agreements with them.
International transfers
Where a sub-processor handles personal data outside the UK, we rely on UK adequacy regulations (for the EU and EEA, and for US companies certified under the UK–US data bridge) or the ICO's International Data Transfer Agreement or Addendum. Our privacy notice has more. Questions: engineering@vereon.tech.