Sub-processors.
Every third party that may process your data, where they are, and why.
Clockwork CRM sub-processors
This is the list referred to in clause 6.2 of our Data Processing Agreement. It names every third party that may process personal data held in your Clockwork CRM instance, what they do, and the country they do it in.
We give 30 days' notice before we add or replace a sub-processor, and you may object on reasonable data protection grounds. To receive those notifications, email privacy@mythic.software.
Last updated 22 September 2026.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft Ireland Operations Limited Azure | Cloud hosting, virtual machines, file storage, message queue, secret management and backup | All data held in your Clockwork CRM instance | United Kingdom (UK South) |
| Microsoft Ireland Operations Limited Azure AI Speech | Speech-to-text transcription of call recordings, where you enable it | Call audio and the resulting transcripts | United Kingdom (UK South) |
| Microsoft Ireland Operations Limited Azure Communication Services | Delivery of system and notification email | Recipient name and email address, message content | United Kingdom |
| Amazon Web Services EMEA SARL Amazon SES | Delivery of system, notification and marketing email | Recipient name and email address, message content, delivery and engagement events | United Kingdom (eu-west-2, London) |
| Hertza L.L.C. ZeroBounce | Verification that recipient email addresses are deliverable, when you run the mailing list cleaner before a bulk email send | The email addresses submitted for validation, retained by ZeroBounce for no more than 30 days | European Union |
| Twilio Ireland Limited | Inbound and outbound calling and SMS, telephone number provisioning, where you enable it | Phone numbers, call metadata, SMS content, and call recordings transiently | United States (us1) |
| Stripe Payments Europe Limited | Subscription billing and payment processing | Billing name, address, email, payment method tokens, transaction history. No CRM record data. | Ireland and United States |
| OpenAI Ireland Limited | Optional AI text and image generation, only when one of your users invokes it | The content of that user's prompt, which may contain personal data if the user includes it | United States |
| Functional Software, Inc. Sentry | Application error and performance monitoring | Incidental personal data contained in error reports, stack traces and request context | Germany (EU region) |
| Companies House | Company registration lookup when a user searches for a company | The company name or registration number the user typed | United Kingdom |
| Google Ireland Limited reCAPTCHA | Spam protection on public forms and landing pages served by Clockwork CRM | IP address and interaction signals of the form visitor | United States |
Where your data actually lives
Your database, your files, the message queue, secret management, backups, call transcription and system email are all configured to United Kingdom regions.
- Sentry is in the EU (Germany). Error reports can incidentally contain personal data in stack traces. The UK has adequacy regulations covering the EEA, so this is not a restricted transfer and no International Data Transfer Agreement is required.
- ZeroBounce processes validation requests in the EU, which is likewise covered by the UK's adequacy regulations for the EEA. ZeroBounce is a US company and its personnel in the United States can access account registration data; that access is covered by Standard Contractual Clauses and the UK Addendum. Addresses submitted for validation are deleted by ZeroBounce within 30 days.
- OpenAI is in the United States, and is used only at the moment one of your users invokes an AI feature. This is a restricted transfer, covered by Standard Contractual Clauses and the UK Addendum. If you would prefer these features switched off on your instance, tell us and we will do it.
- Twilio is in the United States. Call metadata and SMS content are processed there. Call recordings are held there only transiently: once a recording is stored in your own UK file storage, Clockwork CRM deletes it from Twilio.
Microsoft and Amazon support access may originate outside the UK, covered by their respective data processing agreements and transfer mechanisms.
What is not sub-processed
Website analytics inside Clockwork CRM are first-party. Analytics data is stored in your own database, visitor identification is cookieless, and IP-to-location lookup is performed offline against a database held on our own servers. No visitor data is sent to an analytics provider, and no tracking cookie is set.
Support is handled by us over email and is not routed through a third-party ticketing platform.
Integrations you connect yourself
The following are connected by you, to your own accounts. We process the resulting data inside Clockwork CRM, but we do not contract with these providers on your behalf, and your own relationship with them governs the arrangement. They are listed for completeness, not as our sub-processors.
- Microsoft 365 and Microsoft Graph, and Google Workspace, for mailbox and calendar synchronisation
- HubSpot, Pipedrive and Capsule, for a one-off data migration into Clockwork CRM that you initiate
Questions
Email privacy@mythic.software, or read the Data Processing Agreement and our security overview.