Sub-processors
The third-party providers Pactly uses to deliver the Cloud Service, and the data they handle.
Last updated: 27 May 2026
1. What this page is
A sub-processor is any third party that processes customer Personal Data on Pactly’s behalf to deliver the Cloud Service.
Pactly is the Processor (under GDPR Art. 28) / Data Intermediary (under Singapore PDPA s.4(2)) for Customer Data uploaded to the Service. The sub-processors listed below are engaged by Pactly to deliver the Service; each is bound by a Data Processing Agreement consistent with the obligations Pactly owes its customers.
This page is the live list of every sub-processor Pactly uses. It is the source of truth referenced by Pactly’s Cloud Service Agreement and Data Processing Addendum (DPA).
2. How we work with sub-processors
Before engaging any sub-processor, Pactly:
- runs a documented security and privacy review;
- enters into a written contract with the sub-processor that addresses confidentiality and data protection, and that is consistent with the obligations Pactly owes its customers;
- limits the sub-processor’s access to the minimum Personal Data needed; and
- remains fully responsible to the customer for the sub-processor’s performance.
Pactly gives at least 30 calendar days’ written notice before engaging any new sub-processor. Customers can subscribe to update notifications by emailing security@pactly.com. If a customer reasonably objects within the notice period, the parties will discuss the objection in good faith. At the end of the 30-day notice period, the customer will be deemed to have consented to the engagement of the new sub-processor.
3. Always-engaged sub-processors
These providers are used for every Pactly customer as part of the core Service.
| Sub-processor | Purpose | Personal Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, object storage, networking; AI inference via AWS Bedrock | All Customer Data stored or transmitted by the Service | Singapore (default); Malaysia for specific Malaysian customers |
| MongoDB, Inc. (Atlas) | Managed database for structured Customer Data | Structured Customer Data | Singapore (all customers) |
| Cloudflare, Inc. | CDN, web application firewall, DDoS mitigation, TLS termination | Request metadata and content in transit | Global edge, routed via nearest point of presence |
| Mailgun Technologies, Inc. (Sinch Email business unit) | Transactional email delivery (notifications, signing requests, system mail) | Recipient email, sender name, subject, email body | United States |
| Aspose Pty Ltd (Aspose.Words Cloud) | DOCX and PDF conversion | Document content submitted for conversion | United States |
| Google LLC (Cloud Vision) | Optical character recognition (OCR) for scanned documents | Image content of scanned documents; extracted text | United States |
| Cerebras Systems, Inc. | Latency-sensitive AI inference | Short text excerpts submitted for inference | United States |
| Langfuse GmbH | Observability and quality monitoring of AI features | Telemetry from AI feature requests for observability and quality monitoring | European Union (Germany) |
| Functional Software, Inc. (Sentry) | Error monitoring, performance tracing, UI diagnostics | Error events, stack traces, and request metadata for service reliability. Customer Document Content, party details, and user account data are masked before transmission. | United States |
| Not Just Tickets Ltd. (trading as Plain) | Customer support (in-app chat, email thread management) | Contact details of Pactly customer admin users and support conversation content. Customers are advised not to share Customer Document Content via support chat; the customer is the Controller of any content they choose to share through support. | United Kingdom |
4. Feature-conditional sub-processors
These providers are engaged only when a specific feature is enabled or used.
| Sub-processor | Engaged when | Purpose | Location |
|---|---|---|---|
| Anthropic, PBC | Engaged as a fallback AI provider when AWS Bedrock is unavailable | AI-assisted contract review, drafting, and analysis | United States |
| OpenAI, L.L.C. | Engaged as a fallback AI provider when AWS Bedrock is unavailable | AI-assisted contract review, drafting, summarisation; embeddings for in-app search | United States |
| Dilisense GmbH | Customer enables Sanctions / PEP screening | Screening of party names against sanctions and politically exposed person watchlists | European Union |
| SignWell, Inc. | Customer enables SignWell e-signing integration | E-signature processing | United States |
5. Customer-controlled integrations
When a customer connects their own third-party account (typically by providing an API key or completing an OAuth flow), data flows from Pactly to that third party at the customer’s direction. The customer contracts directly with the third party and is the Controller in that relationship. These vendors are not Pactly sub-processors and are listed here for transparency only.
- DocuSign (e-signature integration)
- Adobe Acrobat Sign (e-signature integration)
- Microsoft Entra ID, Okta (single sign-on)
6. Notification of changes
When a sub-processor is added or removed, Pactly will:
- update this page on or before the effective date;
- email subscribed customers at least 30 calendar days before engaging any new sub-processor; and
- log the change in the Changelog below.
To subscribe, email security@pactly.com.
To object to a proposed new sub-processor, reply to the notification email or contact your Pactly account manager within the notice period.
7. Changelog
| Date | Change |
|---|---|
| 27 May 2026 | v1 of the publicly accessible sub-processor list. |