How many subprocessors does Cloudbeds use?

Cloudbeds lists 37 subprocessors on its published list, including Stripe Platform, Stripe Direct, DLocal, PayPal, and Adyen and 32 more.

Where does Cloudbeds process customer data?

The subprocessors named by Cloudbeds are located in United States, Brazil, Canada, Mexico, Argentina, and Asia Pacific and 13 other locations, as stated on its list.

How quickly does Cloudbeds report a personal data breach to customers?

According to its DPA, Cloudbeds reports a personal data breach to customers within 72 hours: “Cloudbeds will notify Client without any undue delay, and in no event longer than 72 hours after becoming aware of a Security Incident.”

How much notice does Cloudbeds give before adding a subprocessor?

Cloudbeds's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We will not add any additional Subprocessors without informing you of such Subprocessors by giving you at least thirty (30) days' notice before allowing any new Subprocessor to Process Client Personal Data ("Subprocessor Notice Period").”

How does Cloudbeds transfer personal data outside the EU?

Cloudbeds's DPA relies on standard contractual clauses and adequacy decisions: “The EU SCCs are hereby incorporated into this Addendum by reference as follows: (i) Client is the "data exporter" (ii) Digital Arbitrage, Inc., (d/b/a Cloudbeds) is the "data importer".”

Which security certifications does Cloudbeds list?

Cloudbeds's trust page lists PCI DSS.

When was Cloudbeds's subprocessor list last checked?

ClauseTrail last checked Cloudbeds's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Cloudbeds adds or removes a subprocessor?

ClauseTrail monitors Cloudbeds's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Cloudbeds Subprocessors List (November 2026): Changes and History

Cloudbeds names 37 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Cloudbeds subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Stripe Platform	Payment Processing	United States, Canada, Europe, Mexico, Asia Pacific, Hong Kong, Japan, Singapore, UAE
2	Stripe Direct	Payment Processing	—
3	DLocal	Payment Processing	Thailand
4	PayPal	Payment Processing	United States
5	Adyen	Payment Processing	EU
6	PayU Latam	Payment Processing	Argentina, Brazil, Colombia, Mexico, Chile, Panama, Peru
7	Ixopay	Payment Processing	United States, Canada, Puerto Rico, Australia
8	MaxiPago!	Payment Processing	Brazil
9	Amazon AWS	Application and Data Hosting	United States
10	G Suite (Google Workspace)	Productivity and Collaboration	United States
11	Office365	Productivity and Collaboration	United States
12	Slack	Communication and Support	United States
13	Zoom	Customer support and communication	United States
14	DialPad	Customer support and communication	United States
15	Jira	Collaboration and tracking services	United States
16	Sendgrid	Transactional email delivery	United States
17	Zendesk	Customer Support	United States
18	Assembled	Customer Support Operations	United States
19	Forethought	Customer Support Operations	United States
20	N8N	Customer Support Operations	United States
21	Anthropic	Customer Support Operations	United States
22	Pinecone	Customer Support Operations	United States
23	Momentum	Customer Support Operations	United States
24	OpenAI	Customer Support Operations	United States
25	Okta	Identity and Access Management	United States
26	DataDog	Cloud Monitoring and Performance	United States
27	Loki	Cloud Monitoring and Performance	United States
28	Tempo	Cloud Monitoring and Performance	United States
29	DocuSign	Digital transaction management	United States
30	SnowFlake	Data Analysis	United States
31	Tableau	Data Analysis	United States
32	SalesForce	Sales Support	United States
33	Google Analytics	Application Advertising Analytics	United States
34	QuickInsight	Data Analytics	United States
35	Pendo	Data Analytics and Tracking	United States
36	Hotjar	Data Analytics and Tracking	United States
37	Salesloft	Data Analytics and Tracking	United States

Get an email when Cloudbeds changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Cloudbeds free

Key DPA terms at Cloudbeds

What Cloudbeds's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Cloudbeds will notify Client without any undue delay, and in no event longer than 72 hours after becoming aware of a Security Incident.”
DPA, www.cloudbeds.com ↗
Notice of a new subprocessor: 30 days ahead

“We will not add any additional Subprocessors without informing you of such Subprocessors by giving you at least thirty (30) days' notice before allowing any new Subprocessor to Process Client Personal Data ("Subprocessor Notice Period").”
DPA, www.cloudbeds.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“The EU SCCs are hereby incorporated into this Addendum by reference as follows: (i) Client is the "data exporter" (ii) Digital Arbitrage, Inc., (d/b/a Cloudbeds) is the "data importer".”

“Where Personal Data protected by the EU Data Protection Laws is transferred, either directly or via onward transfer, to a country outside of Europe that is not subject to an adequacy decision, the following applies:”
DPA, www.cloudbeds.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Following expiration or termination of the Agreement, Cloudbeds must, in accordance with the Documentation, delete all Client Personal Data.”
DPA, www.cloudbeds.com ↗
Audit rights: Once a year

“provided that such right may only be exercised no more than once every twelve (12) months.”
DPA, www.cloudbeds.com ↗

Certifications at Cloudbeds

What Cloudbeds's trust page lists, with the text each one comes from.

PCI DSS: Active

“PCI DSS level 1 & 2 certified”
Trust page, www.cloudbeds.com ↗

Documents we track for Cloudbeds

DPA: checked November 3, 2026 changed October 8, 2026 www.cloudbeds.com ↗
Privacy policy: checked November 3, 2026 www.cloudbeds.com ↗
Subprocessor list: checked November 2, 2026 www.cloudbeds.com ↗
Terms of service: checked November 3, 2026 www.cloudbeds.com ↗
Trust page: checked November 3, 2026 www.cloudbeds.com ↗

Change history

October 8, 2026

DPA changed

Two new subprocessors, Momentum and OpenAI, were added to the Customer Support Operations category (United States) in the subprocessor list.

Tracking since October 9, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Cloudbeds subprocessors FAQ

How many subprocessors does Cloudbeds use?: Cloudbeds lists 37 subprocessors on its published list, including Stripe Platform, Stripe Direct, DLocal, PayPal, and Adyen and 32 more.
Where does Cloudbeds process customer data?: The subprocessors named by Cloudbeds are located in United States, Brazil, Canada, Mexico, Argentina, and Asia Pacific and 13 other locations, as stated on its list.
How quickly does Cloudbeds report a personal data breach to customers?: According to its DPA, Cloudbeds reports a personal data breach to customers within 72 hours: “Cloudbeds will notify Client without any undue delay, and in no event longer than 72 hours after becoming aware of a Security Incident.”
How much notice does Cloudbeds give before adding a subprocessor?: Cloudbeds's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We will not add any additional Subprocessors without informing you of such Subprocessors by giving you at least thirty (30) days' notice before allowing any new Subprocessor to Process Client Personal Data ("Subprocessor Notice Period").”
How does Cloudbeds transfer personal data outside the EU?: Cloudbeds's DPA relies on standard contractual clauses and adequacy decisions: “The EU SCCs are hereby incorporated into this Addendum by reference as follows: (i) Client is the "data exporter" (ii) Digital Arbitrage, Inc., (d/b/a Cloudbeds) is the "data importer".”
Which security certifications does Cloudbeds list?: Cloudbeds's trust page lists PCI DSS.
When was Cloudbeds's subprocessor list last checked?: ClauseTrail last checked Cloudbeds's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Cloudbeds adds or removes a subprocessor?: ClauseTrail monitors Cloudbeds's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.