How many subprocessors does Payhawk use?

Payhawk lists 3 subprocessors on its published list, including Payhawk EOOD, Merge API, Inc.¹, and Duffel Technology Limited².

Where does Payhawk process customer data?

The subprocessors named by Payhawk are located in Belgium, Germany, Sweden, and United Kingdom, as stated on its list.

How quickly does Payhawk report a personal data breach to customers?

According to its DPA, Payhawk reports a personal data breach to customers without undue delay, with no set deadline: “the Processor must notify the Controller thereof without undue delay and provide the Controller with comprehensive information enabling the latter to fulfill its obligations”

How much notice does Payhawk give before adding a subprocessor?

Payhawk's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “The Processor shall notify the Controller of any intended changes to the List of Sub-Processors in Schedule 2 of this DPA ("List of Sub-Processors") at least thirty (30) days in advance.”

Does Payhawk have a SOC 2 Type II report?

Yes. Payhawk's trust page lists a SOC 2 Type II report: “soc2 type 2 certificate logo”

Which security certifications does Payhawk list?

Payhawk's trust page lists SOC 2 Type II, ISO 27001, PCI DSS, and CSA STAR.

When was Payhawk's subprocessor list last checked?

ClauseTrail last checked Payhawk's subprocessor list on November 3, 2026. Lists are re-checked daily.

How do I find out when Payhawk adds or removes a subprocessor?

ClauseTrail monitors Payhawk's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Payhawk Subprocessors List (November 2026): Changes and History

Payhawk names 3 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 3, 2026 Official source ↗

Payhawk subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Payhawk EOOD	Payhawk Platform provider	Belgium, Germany
2	Merge API, Inc.¹	API provider for HR Integrations through Payhawk	Sweden
3	Duffel Technology Limited²	API provider for connectivity with airlines and accommodation providers	United Kingdom

Get an email when Payhawk changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Payhawk free

Key DPA terms at Payhawk

What Payhawk's data processing agreement commits to, with the sentence each answer comes from.

Breach notification: Without undue delay, with no set deadline

“the Processor must notify the Controller thereof without undue delay and provide the Controller with comprehensive information enabling the latter to fulfill its obligations”
DPA, payhawk.com ↗
Notice of a new subprocessor: 30 days ahead

“The Processor shall notify the Controller of any intended changes to the List of Sub-Processors in Schedule 2 of this DPA ("List of Sub-Processors") at least thirty (30) days in advance.”
DPA, payhawk.com ↗
Customer data after the contract ends: Deleted within 90 days of the contract ending

“For the duration of the Framework Agreement and deleted 90 days after its expiration or termination, unless the Controller has instructed otherwise.”
DPA, payhawk.com ↗
Audit rights: Once a year

“The Audit Request shall include at least the scope and duration of the audit and shall not be conducted more than once per year, unless otherwise required under Data Protection Laws.”
DPA, payhawk.com ↗

Certifications at Payhawk

What Payhawk's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“soc2 type 2 certificate logo”
Trust page, payhawk.com ↗
ISO 27001: Active

“iso 27001 certificate”
Trust page, payhawk.com ↗
PCI DSS: Active

“pci dss compliant logo”
Trust page, payhawk.com ↗
CSA STAR: Active

“CSA STAR Level 1”
Trust page, payhawk.com ↗

Documents we track for Payhawk

DPA: checked November 3, 2026 payhawk.com ↗
Privacy policy: checked November 3, 2026 payhawk.com ↗
Subprocessor list: checked November 3, 2026 payhawk.com ↗
Terms of service: checked November 3, 2026 payhawk.com ↗
Trust page: checked November 3, 2026 payhawk.com ↗

Change history

Tracking since October 18, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Payhawk subprocessors FAQ

How many subprocessors does Payhawk use?: Payhawk lists 3 subprocessors on its published list, including Payhawk EOOD, Merge API, Inc.¹, and Duffel Technology Limited².
Where does Payhawk process customer data?: The subprocessors named by Payhawk are located in Belgium, Germany, Sweden, and United Kingdom, as stated on its list.
How quickly does Payhawk report a personal data breach to customers?: According to its DPA, Payhawk reports a personal data breach to customers without undue delay, with no set deadline: “the Processor must notify the Controller thereof without undue delay and provide the Controller with comprehensive information enabling the latter to fulfill its obligations”
How much notice does Payhawk give before adding a subprocessor?: Payhawk's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “The Processor shall notify the Controller of any intended changes to the List of Sub-Processors in Schedule 2 of this DPA ("List of Sub-Processors") at least thirty (30) days in advance.”
Does Payhawk have a SOC 2 Type II report?: Yes. Payhawk's trust page lists a SOC 2 Type II report: “soc2 type 2 certificate logo”
Which security certifications does Payhawk list?: Payhawk's trust page lists SOC 2 Type II, ISO 27001, PCI DSS, and CSA STAR.
When was Payhawk's subprocessor list last checked?: ClauseTrail last checked Payhawk's subprocessor list on November 3, 2026. Lists are re-checked daily.
How do I find out when Payhawk adds or removes a subprocessor?: ClauseTrail monitors Payhawk's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.