How many subprocessors does Custify use?

Custify lists 4 subprocessors on its published list, including Amazon Web Services EMEA SARL, MongoDB Limited, Slack Technologies Limited, and Google Ireland Limited.

Does Custify use customer data to train AI models?

According to its AI terms, Custify does not use customer data to train AI models: “No customer data is retained for training or exported to third parties.”

Which AI model providers does Custify send customer data to?

Amazon Bedrock is named in Custify's AI terms: “CustifyAI exclusively relies on AWS Bedrock for AI services, unless otherwise specified at the feature level.”

How quickly does Custify report a personal data breach to customers?

According to its DPA, Custify reports a personal data breach to customers without undue delay, with no set deadline: “In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach.”

How much notice does Custify give before adding a subprocessor?

Custify's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 15 business days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s).”

How does Custify transfer personal data outside the EU?

Custify's DPA relies on standard contractual clauses and adequacy decisions: “the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 and are hereby authorized to transfer the controller's personal data to third-countries by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679 provided the conditions for the use of those standard contractual clauses are met, or adequacy decisions.”

When was Custify's subprocessor list last checked?

ClauseTrail last checked Custify's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Custify adds or removes a subprocessor?

ClauseTrail monitors Custify's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Custify Subprocessors List (November 2026): Changes and History

Custify names 4 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Custify subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services EMEA SARL	Providing hosting and virtual infrastructure, communication and management systems	—
2	MongoDB Limited	Providing database platform services	—
3	Slack Technologies Limited	Providing messaging and communication tools and services. Only relevant if Client decides to expose PII via support chat.	—
4	Google Ireland Limited	Providing messaging and communication tools and services. Only relevant if Client decides to expose PII via support email.	—

Get an email when Custify changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Custify free

AI and customer data at Custify

What Custify's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: No

“No customer data is retained for training or exported to third parties.”
AI terms, www.custify.com ↗
Sends customer data to AI model providers: Yes: Amazon Bedrock

“Data processed by CustifyAI remains within the secure environment of AWS Bedrock , in compliance with AWS SOC2 policies.”
AI terms, www.custify.com ↗
How to opt out: AI features are enabled by default for all customers but admins can disable them at the account level.

“AI features are enabled by default to all customers but can be disabled at the account level by admins.”
AI terms, www.custify.com ↗
How long AI features keep data: Data processed by AI is not stored beyond the duration of the specific task.

“Customer data processed by AI is not stored beyond the duration of the task.”
AI terms, www.custify.com ↗

Key DPA terms at Custify

What Custify's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach.”
DPA, www.custify.com ↗
Notice of a new subprocessor: 15 days ahead

“The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 15 business days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s).”
DPA, www.custify.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 and are hereby authorized to transfer the controller's personal data to third-countries by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679 provided the conditions for the use of those standard contractual clauses are met, or adequacy decisions.”

“the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 and are hereby authorized to transfer the controller's personal data to third-countries by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679 provided the conditions for the use of those standard contractual clauses are met, or adequacy decisions.”
DPA, www.custify.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Following termination of the DPA, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all existing personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data.”
DPA, www.custify.com ↗
Audit rights: On request

“At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance.”
DPA, www.custify.com ↗

Documents we track for Custify

AI terms: checked November 3, 2026 www.custify.com ↗
DPA: checked November 3, 2026 www.custify.com ↗
Privacy policy: checked November 3, 2026 www.custify.com ↗
Subprocessor list: checked November 2, 2026 www.custify.com ↗
Terms of service: checked November 3, 2026 www.custify.com ↗

Change history

Tracking since October 9, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Custify subprocessors FAQ

How many subprocessors does Custify use?: Custify lists 4 subprocessors on its published list, including Amazon Web Services EMEA SARL, MongoDB Limited, Slack Technologies Limited, and Google Ireland Limited.
Does Custify use customer data to train AI models?: According to its AI terms, Custify does not use customer data to train AI models: “No customer data is retained for training or exported to third parties.”
Which AI model providers does Custify send customer data to?: Amazon Bedrock is named in Custify's AI terms: “CustifyAI exclusively relies on AWS Bedrock for AI services, unless otherwise specified at the feature level.”
How quickly does Custify report a personal data breach to customers?: According to its DPA, Custify reports a personal data breach to customers without undue delay, with no set deadline: “In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach.”
How much notice does Custify give before adding a subprocessor?: Custify's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 15 business days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s).”
How does Custify transfer personal data outside the EU?: Custify's DPA relies on standard contractual clauses and adequacy decisions: “the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 and are hereby authorized to transfer the controller's personal data to third-countries by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679 provided the conditions for the use of those standard contractual clauses are met, or adequacy decisions.”
When was Custify's subprocessor list last checked?: ClauseTrail last checked Custify's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Custify adds or removes a subprocessor?: ClauseTrail monitors Custify's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.