How many subprocessors does Paddle use?

Paddle lists 3 subprocessors on its published list, including Amazon Web Services (AWS), Postmark, and Twilio.

How quickly does Paddle report a personal data breach to customers?

According to its DPA, Paddle reports a personal data breach to customers without undue delay, with no set deadline: “Provider shall, to the extent permitted by law, notify Customer without undue delay upon Provider or any Sub-processor becoming aware of a Personal Data Breach”

How much notice does Paddle give before adding a subprocessor?

Paddle's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “If, within 14 days of receipt of that notice, Customer notifies Provider in writing of any objections”

How does Paddle transfer personal data outside the EU?

Paddle's DPA relies on standard contractual clauses and adequacy decisions: “have entered into Standard Contractual Clauses with the Processor”

When was Paddle's subprocessor list last checked?

ClauseTrail last checked Paddle's subprocessor list on September 26, 2026. Lists are re-checked daily.

How do I find out when Paddle adds or removes a subprocessor?

ClauseTrail monitors Paddle's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Paddle Subprocessors List (September 2026): Changes and History

Paddle names 3 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 26, 2026 Official source ↗

Paddle subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services (AWS)	We use AWS as Infrastructure-As-A-Service (IaaS), which means we rent servers from AWS, but AWS does not actually have access to the data on those servers.	—
2	Postmark	We use Postmark to send Retain emails. They do not do any processing logic, and do not have access to the raw customer data, but they would be able to see all of our outgoing email content.	—
3	Twilio	For customers with Retain SMS Dunning, we use Twilio for sending those text messages through the phone system.	—

Get an email when Paddle changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Paddle free

Key DPA terms at Paddle

What Paddle's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Provider shall, to the extent permitted by law, notify Customer without undue delay upon Provider or any Sub-processor becoming aware of a Personal Data Breach”
DPA, www.paddle.com ↗
Notice of a new subprocessor: 14 days ahead

“If, within 14 days of receipt of that notice, Customer notifies Provider in writing of any objections”
DPA, www.paddle.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“have entered into Standard Contractual Clauses with the Processor”

“are located in a third country or territory recognised by the EU Commission to have an adequate level of protection”
DPA, www.paddle.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Provider shall comply with any such written request within 30 days of the Cessation Date.”
DPA, www.paddle.com ↗
Audit rights: Once a year

“for the purposes of more than one audit or inspection, in respect of Provider or each Sub-processor, in any calendar year”
DPA, www.paddle.com ↗

Documents we track for Paddle

DPA: checked September 26, 2026 www.paddle.com ↗
Privacy policy: checked September 26, 2026 www.paddle.com ↗
Subprocessor list: checked September 26, 2026 www.paddle.com ↗
Terms of service: checked September 26, 2026 www.paddle.com ↗

Change history

Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Paddle subprocessors FAQ

How many subprocessors does Paddle use?: Paddle lists 3 subprocessors on its published list, including Amazon Web Services (AWS), Postmark, and Twilio.
How quickly does Paddle report a personal data breach to customers?: According to its DPA, Paddle reports a personal data breach to customers without undue delay, with no set deadline: “Provider shall, to the extent permitted by law, notify Customer without undue delay upon Provider or any Sub-processor becoming aware of a Personal Data Breach”
How much notice does Paddle give before adding a subprocessor?: Paddle's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “If, within 14 days of receipt of that notice, Customer notifies Provider in writing of any objections”
How does Paddle transfer personal data outside the EU?: Paddle's DPA relies on standard contractual clauses and adequacy decisions: “have entered into Standard Contractual Clauses with the Processor”
When was Paddle's subprocessor list last checked?: ClauseTrail last checked Paddle's subprocessor list on September 26, 2026. Lists are re-checked daily.
How do I find out when Paddle adds or removes a subprocessor?: ClauseTrail monitors Paddle's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.