How many subprocessors does Appcues use?

Appcues lists 7 subprocessors on its published list, including Amazon Web Services, ClickHouse, Confluent, Snowflake, and Mailgun and 2 more.

Where does Appcues process customer data?

The subprocessors named by Appcues are located in EU, USA, EU: Frankfurt, Germany, and USA: Oregon, as stated on its list.

How quickly does Appcues report a personal data breach to customers?

According to its DPA, Appcues reports a personal data breach to customers without undue delay, with no set deadline: “Without undue delay, inform Customer of any Personal Data Breach.”

How does Appcues transfer personal data outside the EU?

Appcues's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “During any period in which (i) the EU-US Data Privacy Framework is in effect and may legally serve as a valid data transfer mechanism under GDPR”

Does Appcues have a SOC 2 Type II report?

Yes. Appcues's trust page lists a SOC 2 Type II report: “2025 SOC 2 Type 2 Report Available”

Which security certifications does Appcues list?

Appcues's trust page lists SOC 2 Type II and HIPAA.

When was Appcues's subprocessor list last checked?

ClauseTrail last checked Appcues's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Appcues adds or removes a subprocessor?

ClauseTrail monitors Appcues's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Appcues Subprocessors List (November 2026): Changes and History

Appcues names 7 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Appcues subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Primary infrastructure provider for Appcues applications and services	USA, EU, USA: Oregon, EU: Frankfurt, Germany
2	ClickHouse	Provides managed database services.	USA, EU
3	Confluent	Infrastructure provider, managing Apache Kafka as a service.	USA, EU
4	Snowflake	Analytics database for calculating aggregate statistics for production.	USA, EU
5	Mailgun	Used for delivering emails as part of the Appcues out-of-product messaging product.	USA, EU
6	OpenAI	Provides AI model services for optional Appcues AI features.	USA, EU
7	Langfuse	Provides monitoring and quality testing tools for optional Appcues AI features	USA, EU

Get an email when Appcues changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Appcues free

Key DPA terms at Appcues

What Appcues's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Without undue delay, inform Customer of any Personal Data Breach.”
DPA, www.appcues.com ↗
Transfers outside the EU: Standard contractual clauses and the EU–US Data Privacy Framework

“During any period in which (i) the EU-US Data Privacy Framework is in effect and may legally serve as a valid data transfer mechanism under GDPR”

“Customer and Appcues and each Authorized Affiliate hereby enter into the Standard Contractual Clauses in respect of such Restricted Transfer”
DPA, www.appcues.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“At any time upon Customer's request, Appcues will return to Customer all Customer Personal Data and any copies thereof or will destroy all such Customer Personal Data and certify to Customer that it has done so”
DPA, www.appcues.com ↗
Audit rights: Once a year

“Customer's audit right pursuant to Section 6.2 (Third-Party Certifications and Audits) is limited to once in any twelve-month period.”
DPA, www.appcues.com ↗

Certifications at Appcues

What Appcues's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“2025 SOC 2 Type 2 Report Available”
Trust page, trust.appcues.com ↗
HIPAA: Active

“HIPAA support is not available in the EU hosting environment.”
Trust page, trust.appcues.com ↗

Documents we track for Appcues

DPA: checked November 3, 2026 changed October 28, 2026 www.appcues.com ↗
Privacy policy: checked November 3, 2026 changed October 28, 2026 www.appcues.com ↗
Subprocessor list: checked November 2, 2026 trust.appcues.com ↗
Terms of service: checked November 3, 2026 changed October 28, 2026 www.appcues.com ↗
Trust page: checked November 2, 2026 trust.appcues.com ↗

Change history

Tracking since October 17, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Appcues subprocessors FAQ

How many subprocessors does Appcues use?: Appcues lists 7 subprocessors on its published list, including Amazon Web Services, ClickHouse, Confluent, Snowflake, and Mailgun and 2 more.
Where does Appcues process customer data?: The subprocessors named by Appcues are located in EU, USA, EU: Frankfurt, Germany, and USA: Oregon, as stated on its list.
How quickly does Appcues report a personal data breach to customers?: According to its DPA, Appcues reports a personal data breach to customers without undue delay, with no set deadline: “Without undue delay, inform Customer of any Personal Data Breach.”
How does Appcues transfer personal data outside the EU?: Appcues's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “During any period in which (i) the EU-US Data Privacy Framework is in effect and may legally serve as a valid data transfer mechanism under GDPR”
Does Appcues have a SOC 2 Type II report?: Yes. Appcues's trust page lists a SOC 2 Type II report: “2025 SOC 2 Type 2 Report Available”
Which security certifications does Appcues list?: Appcues's trust page lists SOC 2 Type II and HIPAA.
When was Appcues's subprocessor list last checked?: ClauseTrail last checked Appcues's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Appcues adds or removes a subprocessor?: ClauseTrail monitors Appcues's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.