How many subprocessors does Gorgias use?

Gorgias lists 24 subprocessors on its published list, including Cloudflare, Google Cloud Platform, Segment, Confluent, and Appcues and 19 more.

Where does Gorgias process customer data?

The subprocessors named by Gorgias are located in United States, Australia, Canada, European Union, France, and Netherlands and 1 other locations, as stated on its list.

Does Gorgias use customer data to train AI models?

According to its terms of service, Gorgias may use customer data to train AI models: “Gorgias may, without providing any compensation to Customer or to any third party, use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output (as defined below), solely to build and improve our internal machine learning and other artificial intelligence models”

How quickly does Gorgias report a personal data breach to customers?

According to its DPA, Gorgias reports a personal data breach to customers within 72 hours: “Gorgias shall notify Customer without undue delay, and in any event within 72 hours after Gorgias becomes aware of a Security Breach.”

How much notice does Gorgias give before adding a subprocessor?

Gorgias's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Gorgias will inform Customer of its intention to engage any new or replacement Subprocessors in writing at least fifteen (15) days in advance of the date of the intended commencement of the engagement.”

How does Gorgias transfer personal data outside the EU?

Gorgias's DPA relies on standard contractual clauses: “Customer and Gorgias agree that the transfer shall be undertaken pursuant to Standard Contractual Clauses which form integral part of this DPA.”

When was Gorgias's subprocessor list last checked?

ClauseTrail last checked Gorgias's subprocessor list on September 26, 2026. Lists are re-checked daily.

How do I find out when Gorgias adds or removes a subprocessor?

ClauseTrail monitors Gorgias's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Gorgias Subprocessors List (September 2026): Changes and History

Gorgias names 24 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 26, 2026 Official source ↗

Gorgias subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Cloudflare	Third-party content delivery network	United States
2	Google Cloud Platform	Cloud Service Provider	United States, European Union, Australia
3	Segment	Data Infrastructure	United States
4	Confluent	Full-scale data streaming platform	United States
5	Appcues	Survey and onboarding	United States
6	Amplitude	Product analytics	United States
7	Circle	Community hosting platform	United States
8	Chargebee	Subscription billing and revenue management platform	United States
9	Customer io.	Customer communication	United States
10	Datadog	Querying and performing analytics	United States
11	Fivetran	Data ingestion for analytics purpose	United States
12	Google Workspace and Analytics	Email, file storage, video	United States
13	Hubspot	Third-party CRM	United States
14	Microsoft	Product analytics	United States
15	OpenAi	AI research and deployment company	United States
16	Pandadoc	E-Signature legal	United States
17	Sentry	Application error logging	United States
18	Stripe	Customer payments	United States
19	Smooch	Chat data	United States
20	Twilio, Inc.	Voice functionality and SMS	United States
21	Gorgias SAS	Service and Support	France
22	Gorgias Helpdesk Inc	Service and Support	Canada
23	Gorgias B.V.	Service and Support	Netherlands
24	Gorgias d.o.o.	Service and Support	Serbia

Get an email when Gorgias changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Gorgias free

AI and customer data at Gorgias

What Gorgias's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: Yes

“Gorgias may, without providing any compensation to Customer or to any third party, use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output (as defined below), solely to build and improve our internal machine learning and other artificial intelligence models”
Terms of service, www.gorgias.com ↗
Sends customer data to AI model providers: Yes

“Any third-party provider utilized by Gorgias will operate under a zero-data-retention policy and will not use Customer Data to improve or train their models”
Terms of service, www.gorgias.com ↗
How to opt out: Not stated in the documents we track.
How long AI features keep data: Third-party providers operate under a zero-data-retention policy for Customer Data used in AI features.

“Any third-party provider utilized by Gorgias will operate under a zero-data-retention policy and will not use Customer Data to improve or train their models”
Terms of service, www.gorgias.com ↗

Key DPA terms at Gorgias

What Gorgias's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Gorgias shall notify Customer without undue delay, and in any event within 72 hours after Gorgias becomes aware of a Security Breach.”
DPA, www.gorgias.com ↗
Notice of a new subprocessor: 15 days ahead

“Gorgias will inform Customer of its intention to engage any new or replacement Subprocessors in writing at least fifteen (15) days in advance of the date of the intended commencement of the engagement.”
DPA, www.gorgias.com ↗
Transfers outside the EU: Standard contractual clauses

“Customer and Gorgias agree that the transfer shall be undertaken pursuant to Standard Contractual Clauses which form integral part of this DPA.”
DPA, www.gorgias.com ↗
Customer data after the contract ends: Deleted within 90 days of the contract ending

“Gorgias shall, promptly and in any event within 90 days of expiration or termination of the Agreement, or following receipt of written notice from, (a) return a complete copy of all Personal Data to Customer”
DPA, www.gorgias.com ↗
Audit rights: Once a year

“Customer may audit Gorgias's compliance with its obligations under this DPA no more than once per year.”
DPA, www.gorgias.com ↗

Documents we track for Gorgias

DPA: checked September 26, 2026 www.gorgias.com ↗
Privacy policy: checked September 26, 2026 www.gorgias.com ↗
Subprocessor list: checked September 26, 2026 www.gorgias.com ↗
Terms of service: checked September 26, 2026 www.gorgias.com ↗

Change history

Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Gorgias subprocessors FAQ

How many subprocessors does Gorgias use?: Gorgias lists 24 subprocessors on its published list, including Cloudflare, Google Cloud Platform, Segment, Confluent, and Appcues and 19 more.
Where does Gorgias process customer data?: The subprocessors named by Gorgias are located in United States, Australia, Canada, European Union, France, and Netherlands and 1 other locations, as stated on its list.
Does Gorgias use customer data to train AI models?: According to its terms of service, Gorgias may use customer data to train AI models: “Gorgias may, without providing any compensation to Customer or to any third party, use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output (as defined below), solely to build and improve our internal machine learning and other artificial intelligence models”
How quickly does Gorgias report a personal data breach to customers?: According to its DPA, Gorgias reports a personal data breach to customers within 72 hours: “Gorgias shall notify Customer without undue delay, and in any event within 72 hours after Gorgias becomes aware of a Security Breach.”
How much notice does Gorgias give before adding a subprocessor?: Gorgias's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Gorgias will inform Customer of its intention to engage any new or replacement Subprocessors in writing at least fifteen (15) days in advance of the date of the intended commencement of the engagement.”
How does Gorgias transfer personal data outside the EU?: Gorgias's DPA relies on standard contractual clauses: “Customer and Gorgias agree that the transfer shall be undertaken pursuant to Standard Contractual Clauses which form integral part of this DPA.”
When was Gorgias's subprocessor list last checked?: ClauseTrail last checked Gorgias's subprocessor list on September 26, 2026. Lists are re-checked daily.
How do I find out when Gorgias adds or removes a subprocessor?: ClauseTrail monitors Gorgias's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.