How many subprocessors does Pactflow use?

Pactflow lists 6 subprocessors on its published list, including AWS, Pendo, Chargebee, Stripe, and Segment and 1 more.

Where does Pactflow process customer data?

The subprocessors named by Pactflow are located in United States, as stated on its list.

How quickly does Pactflow report a personal data breach to customers?

According to its DPA, Pactflow reports a personal data breach to customers without undue delay, with no set deadline: “SmartBear shall notify Customer without undue delay after becoming aware of a Personal Data Breach, via email to Customer's designated account owner, administrator, or security contact unless otherwise agreed in writing”

How does Pactflow transfer personal data outside the EU?

Pactflow's DPA relies on standard contractual clauses and adequacy decisions: “Where a Restricted Transfer is made from the EEA, the SCCs are incorporated into this DPA and apply to the transfer as follows:”

When was Pactflow's subprocessor list last checked?

ClauseTrail last checked Pactflow's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Pactflow adds or removes a subprocessor?

ClauseTrail monitors Pactflow's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Pactflow Subprocessors List (November 2026): Changes and History

Pactflow names 6 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Pactflow subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	AWS	Cloud hosting provider	United States
2	Pendo	User onboarding and Experience	United States
3	Chargebee	Subscription management	United States
4	Stripe	Payment Gateway	United States
5	Segment	Analytics	United States
6	Mixpanel	Analytics	United States

Get an email when Pactflow changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Pactflow free

Key DPA terms at Pactflow

What Pactflow's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“SmartBear shall notify Customer without undue delay after becoming aware of a Personal Data Breach, via email to Customer's designated account owner, administrator, or security contact unless otherwise agreed in writing”
DPA, smartbear.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“Where a Restricted Transfer is made from the EEA, the SCCs are incorporated into this DPA and apply to the transfer as follows:”

“The parties acknowledge that transfers of Customer Personal Data to SmartBear that are subject to an applicable adequacy decision do not require a separate approved transfer mechanism.”
DPA, smartbear.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“SmartBear shall, upon Customer's written request made within sixty (60) days after termination, either (i) provide Customer with a commercially reasonable opportunity to export Customer Data then retained in active systems, or (ii) securely delete or anonymize Personal Data”
DPA, smartbear.com ↗
Audit rights: Once a year

“upon Customer's reasonable written request (not less than sixty (60) days in advance) and at mutually agreed upon times no more than once in any 12 month period (unless a Personal Data Breach has occurred or a supervisory authority requires an additional audit)”
DPA, smartbear.com ↗

Documents we track for Pactflow

AI terms: checked November 3, 2026 pactflow.io ↗
DPA: checked November 3, 2026 changed October 28, 2026 smartbear.com ↗
Privacy policy: checked November 3, 2026 smartbear.com ↗
Subprocessor list: checked November 2, 2026 pactflow.io ↗
Terms of service: checked November 3, 2026 smartbear.com ↗
Trust page: checked November 3, 2026 pactflow.io ↗

Change history

October 28, 2026

DPA changed

The DPA adds a new "Third-Party Controller" concept where Customer may act as a Data Processor on SmartBear's behalf, triggering Module Three (Processor to Processor) SCCs instead of Module Two, and channels any audit/information rights of such a Third-Party Controller through Customer (Section 4(f)/Section 7(b)); the Subprocessors List definition is also expanded to require each Subprocessor's name, service and processing location, and hosting providers are now explicitly listed there.

Tracking since October 25, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Pactflow subprocessors FAQ

How many subprocessors does Pactflow use?: Pactflow lists 6 subprocessors on its published list, including AWS, Pendo, Chargebee, Stripe, and Segment and 1 more.
Where does Pactflow process customer data?: The subprocessors named by Pactflow are located in United States, as stated on its list.
How quickly does Pactflow report a personal data breach to customers?: According to its DPA, Pactflow reports a personal data breach to customers without undue delay, with no set deadline: “SmartBear shall notify Customer without undue delay after becoming aware of a Personal Data Breach, via email to Customer's designated account owner, administrator, or security contact unless otherwise agreed in writing”
How does Pactflow transfer personal data outside the EU?: Pactflow's DPA relies on standard contractual clauses and adequacy decisions: “Where a Restricted Transfer is made from the EEA, the SCCs are incorporated into this DPA and apply to the transfer as follows:”
When was Pactflow's subprocessor list last checked?: ClauseTrail last checked Pactflow's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Pactflow adds or removes a subprocessor?: ClauseTrail monitors Pactflow's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.