Bubble Subprocessors List (September 2026): Changes and History
Bubble names 44 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked September 28, 2026
Official source ↗
Bubble subprocessors (September 2026)
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | Amazon Web Services | May process end-user data | — |
| 2 | Anthropic | May process end-user data | — |
| 3 | Birdie | May process end-user data | — |
| 4 | Boldr | User support | — |
| 5 | Cloudflare | CDN | — |
| 6 | Cohere | May process end-user data | — |
| 7 | dbt Labs | May process end-user data | — |
| 8 | ECE | User support | — |
| 9 | Elastic | Logs service | — |
| 10 | Fivetran | May process end-user data | — |
| 11 | Google Cloud | May process end-user data | — |
| 12 | Google Workspace | May process end-user data | — |
| 13 | Hashboard | May process end-user data | — |
| 14 | Honeycomb | Logs service | — |
| 15 | Imgix | May process end-user data | — |
| 16 | Intercom | May process end-user data | — |
| 17 | Observe | May process end-user data | — |
| 18 | OpenAI | May process end-user data | — |
| 19 | Papertrail | May process end-user data | — |
| 20 | Sendgrid | May process end-user data | — |
| 21 | Slack | May process end-user data | — |
| 22 | Snowflake | May process end-user data | — |
| 23 | Sprig | May process end-user data | — |
| 24 | Stitch | May process end-user data | — |
| 25 | UnitQ | May process end-user data | — |
| 26 | Amplitude | Analytics Service; only processes Bubble user data | — |
| 27 | AppOptics | Only processes Bubble user data | — |
| 28 | Atlassian | Only processes Bubble user data | — |
| 29 | CircleCI | Only processes Bubble user data | — |
| 30 | Coda | Only processes Bubble user data | — |
| 31 | Delighted | Analytics Service; only processes Bubble user data | — |
| 32 | Explorium | Only processes Bubble user data | — |
| 33 | Gong | Only processes Bubble user data | — |
| 34 | Google Analytics | Analytics Service; only processes Bubble user data | — |
| 35 | Great Question | Only processes Bubble user data | — |
| 36 | Hex | Only processes Bubble user data | — |
| 37 | Iterable | Only processes Bubble user data | — |
| 38 | MailChimp | Only processes Bubble user data | — |
| 39 | Maze | Only processes Bubble user data | — |
| 40 | Salesforce | Only processes Bubble user data | — |
| 41 | Segment | Analytics Service; only processes Bubble user data | — |
| 42 | Stripe | Only processes Bubble user data | — |
| 43 | Timescale | Only processes Bubble user data | — |
| 44 | Xano | Only processes Bubble user data | — |
Get an email when Bubble changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at Bubble
What Bubble's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Without undue delay, with no set deadline
“Bubble shall notify Customer of a Personal Data Breach without undue delay after becoming aware of the occurrence thereof.”
DPA, bubble.io ↗ - Notice of a new subprocessor
-
30 days ahead
“Bubble will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor Site or by other written means at least thirty (30) days before such Subprocessor Processes Customer Personal Data.”
DPA, bubble.io ↗ - Transfers outside the EU
-
Standard contractual clauses and the EU–US Data Privacy Framework
“"SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.”
“Where Bubble is certified under a scheme (such as the EU–U.S. Data Privacy Framework, UK Extension and/or Swiss–U.S. Data Privacy Framework (as applicable)) that benefits from an adequacy decision of the EU Commission, UK Government and/or Swiss authorities (as applicable), Bubble will rely on such scheme and corresponding adequacy decision for transfers of Customer Personal Data.”
DPA, bubble.io ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Upon expiration or earlier termination of the Agreement, Bubble shall return and/or delete all Customer Personal Data in Bubble's care, custody or control in accordance Customer's instructions as to the post-termination return and deletion of Customer Personal Data expressed in the Agreement, or subject to Section 13.5, Customer's further instructions.”
DPA, bubble.io ↗ - Audit rights
-
Once a year
“Bubble need not cooperate with any audit (a) performed by any individual or entity who has not entered into a non-disclosure agreement with Bubble on terms acceptable to Bubble in respect of information obtained in relation to the audit; (b) outside normal business hours; or (c) on more than one (1) occasion in any calendar year during the term of the Agreement, except for any additional audits that Customer is required to perform under Data Protection Laws.”
DPA, bubble.io ↗
Documents we track for Bubble
- DPA
- checked September 28, 2026 bubble.io ↗
- Privacy policy
- checked September 28, 2026 bubble.io ↗
- Subprocessor list
- checked September 28, 2026 bubble.io ↗
- Trust page
- bubble.io ↗
Change history
Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Bubble subprocessors FAQ
- How many subprocessors does Bubble use?
- Bubble lists 44 subprocessors on its published list, including Amazon Web Services, Anthropic, Birdie, Boldr, and Cloudflare and 39 more.
- How quickly does Bubble report a personal data breach to customers?
- According to its DPA, Bubble reports a personal data breach to customers without undue delay, with no set deadline: “Bubble shall notify Customer of a Personal Data Breach without undue delay after becoming aware of the occurrence thereof.”
- How much notice does Bubble give before adding a subprocessor?
- Bubble's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Bubble will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor Site or by other written means at least thirty (30) days before such Subprocessor Processes Customer Personal Data.”
- How does Bubble transfer personal data outside the EU?
- Bubble's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “"SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.”
- When was Bubble's subprocessor list last checked?
- ClauseTrail last checked Bubble's subprocessor list on September 28, 2026. Lists are re-checked daily.
- How do I find out when Bubble adds or removes a subprocessor?
- ClauseTrail monitors Bubble's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.