How many subprocessors does CommerceTools use?

CommerceTools lists 15 subprocessors on its published list, including Google Ireland Limited, Amazon Web Services EMEA SARL, MongoDB Ltd., CrowdStrike Inc., and Atlassian. Pty Ltd and 10 more.

Where does CommerceTools process customer data?

The subprocessors named by CommerceTools are located in USA, Australia, EU, Germany, UK, and USA or Australia and 7 other locations, as stated on its list.

How quickly does CommerceTools report a personal data breach to customers?

According to its DPA, CommerceTools reports a personal data breach to customers without undue delay, with no set deadline: “commercetools shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”

How does CommerceTools transfer personal data outside the EU?

CommerceTools's DPA relies on standard contractual clauses: “commercetools agrees to abide by and process Personal Data originating from the EEA (European Economic Area), the United Kingdom and Switzerland in compliance with the applicable SCCs and applicable Data Protection Law.”

When was CommerceTools's subprocessor list last checked?

ClauseTrail last checked CommerceTools's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when CommerceTools adds or removes a subprocessor?

ClauseTrail monitors CommerceTools's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

CommerceTools Subprocessors List (September 2026): Changes and History

CommerceTools names 15 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

CommerceTools subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Google Ireland Limited	Cloud Hosting of the Service	Determined by Customer EU (Data Center Belgium), USA or Australia
2	Amazon Web Services EMEA SARL	Cloud Hosting of the Service	Determined by Customer EU (Data Center Germany), USA or Australia
3	MongoDB Ltd.	Database infrastructure (MongoDB Atlas)	Determined by Customer’s Selection of Cloud Hosting of the Service
4	CrowdStrike Inc.	Log Management Platform (Falcon LogScale formerly Humio)	Google EU Data Center Belgium
5	Atlassian. Pty Ltd	Administration of Support Tickets	EU
6	Netlify, Inc.	Web development management	USA
7	Functional Software, Inc. (dba Sentry)	Application monitoring management	USA
8	commercetools Group Companies	Operation and support in the course of 24/7 follow-the-sun support via remote access outside regular business hours	EU, UK, USA, Australia
9	commercetools GmbH (HQ)	—	Germany
10	commercetools Ltd.	—	UK
11	commercetools B.V.	—	Netherlands
12	commercetools Spain, S.L.	—	Spain
13	commercetools France SAS	—	France
14	commercetools AU Pty Ltd	—	Australia
15	Langfuse GmbH	LLM datastream monitoring and production support for optional AI-powered features.	Germany

Get an email when CommerceTools changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track CommerceTools free

Key DPA terms at CommerceTools

What CommerceTools's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“commercetools shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”
DPA, commercetools.com ↗
Transfers outside the EU: Standard contractual clauses

“commercetools agrees to abide by and process Personal Data originating from the EEA (European Economic Area), the United Kingdom and Switzerland in compliance with the applicable SCCs and applicable Data Protection Law.”
DPA, commercetools.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Upon termination of the Service or expiration of the term, subject to applicable Data Protection Law, commercetools will promptly delete Personal Data.”
DPA, commercetools.com ↗
Audit rights: Once a year

“At the Customer's written request and within reasonable intervals but no more than once every 12 months or if there are indications of material non-compliance, commercetools shall make available to Customer all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits.”
DPA, commercetools.com ↗

Documents we track for CommerceTools

DPA: checked September 28, 2026 commercetools.com ↗
Privacy policy: checked September 28, 2026 commercetools.com ↗
Subprocessor list: checked September 28, 2026 commercetools.com ↗
Trust page: trust.commercetools.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

CommerceTools subprocessors FAQ

How many subprocessors does CommerceTools use?: CommerceTools lists 15 subprocessors on its published list, including Google Ireland Limited, Amazon Web Services EMEA SARL, MongoDB Ltd., CrowdStrike Inc., and Atlassian. Pty Ltd and 10 more.
Where does CommerceTools process customer data?: The subprocessors named by CommerceTools are located in USA, Australia, EU, Germany, UK, and USA or Australia and 7 other locations, as stated on its list.
How quickly does CommerceTools report a personal data breach to customers?: According to its DPA, CommerceTools reports a personal data breach to customers without undue delay, with no set deadline: “commercetools shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”
How does CommerceTools transfer personal data outside the EU?: CommerceTools's DPA relies on standard contractual clauses: “commercetools agrees to abide by and process Personal Data originating from the EEA (European Economic Area), the United Kingdom and Switzerland in compliance with the applicable SCCs and applicable Data Protection Law.”
When was CommerceTools's subprocessor list last checked?: ClauseTrail last checked CommerceTools's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when CommerceTools adds or removes a subprocessor?: ClauseTrail monitors CommerceTools's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.