Subprocessors
Who processes data on our behalf
Last updated: September 30, 2026
Tychron Corporation uses a small number of third-party service providers (“subprocessors”) to host, secure and deliver its services. This page lists the subprocessors that may process personal data — including the Service Data that Tychron processes on behalf of its customers — together with what each one does, the categories of data involved and where the processing takes place. It supplements sections 6 (Sharing of Personal Data) and 7 (International Data Transfers) of our Privacy & Cookie Policy.
Every subprocessor is bound by a written data processing agreement that limits it to processing personal data on Tychron's documented instructions, requires appropriate technical and organisational security measures, and includes the EU Standard Contractual Clauses or another lawful transfer mechanism where personal data leaves the European Economic Area, the United Kingdom or Switzerland.
1. Infrastructure and security
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting and storage for Tychron's core infrastructure (the messaging platform, its APIs and databases), and part of the global anycast edge that carries traffic on Tychron's own IP space to the nearest processing node. | Customer account and representative data; service data (routing and message data, call and message detail records); consent event records processed for customers; campaign and compliance submissions. | United States and Canada (storage and processing); global anycast edge (see note below). |
| Cloudflare, Inc. | Hosting of the Atlas customer portal and Tychron's websites; DDoS protection, web application firewall, bot protection and TLS termination for Tychron domains, including customer API and portal traffic, on its global anycast network carrying Tychron's own IP space. | IP addresses and request metadata; the content of API and portal requests while in transit, which may include telephone numbers and message content; portal and website form submissions. | Global anycast edge (see note below); United States (company). |
Both providers form part of GlobalCast, Tychron's anycast delivery architecture: Tychron's own ARIN-issued IP space, announced from 130+ Points of Presence across 95+ cities in 50+ countries. Every call, message and API request enters the network at the point of presence closest to the sender — which may be outside the United States — and is carried on Tychron's IP space to the nearest Tychron processing node. Storage and processing take place in the United States and Canada.
2. Customer communications, support and billing
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| SMTP2GO | Transactional email delivery for Atlas portal notices. | Customer representative names and email addresses; the content of the notice. | United States (dedicated sending infrastructure); New Zealand (company). |
| Zoho Corporation | Zoho Desk for customer trouble tickets; Zoho Campaigns for customer notices such as carrier fee updates. | Customer representative names, email addresses and telephone numbers; ticket content, which may include telephone numbers and message samples submitted for investigation; mailing preferences. | United States. |
| Stripe, Inc. | Payment processing for customer invoices. | Billing contact details. Payment card details are entered directly with Stripe and held by Stripe; Tychron stores only a Stripe account identifier. | United States. |
3. Message delivery and automated analysis
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Google LLC | RCS Business Messaging (RBM) platform through which RCS traffic is delivered. | Telephone numbers, RCS message content and delivery metadata for RCS traffic. | United States (global delivery network). |
| Artificial-intelligence infrastructure provider (contracted; not named) | Automated analysis of campaign and compliance submissions and of messaging traffic for fraud, spam, scams, phishing and policy violations, as described in sections 4.1 and 6 of the Privacy & Cookie Policy. | Campaign and compliance submissions; message content and metadata on channels that are not end-to-end encrypted. | United States. |
Tychron's configuration with its artificial-intelligence infrastructure provider excludes all submitted content from use in training the provider's models. The provider is not named here for security reasons; customers with a data processing agreement may request its identity.
4. Telecommunications providers
Tychron delivers messages and calls through interconnections with carriers and messaging aggregators. These upstream partners receive only the routing and message data needed to deliver traffic and act under confidentiality obligations. They are described as a category in section 6 of the Privacy & Cookie Policy and are not listed individually: Tychron does not disclose its upstream partners.
5. Vendors that do not process personal data
The tychron.com blog is managed in Sanity, a content management system that holds published articles only and no personal data.
6. Changes to this list
Tychron updates this page whenever a subprocessor is added, replaced or removed, and the “Last updated” date above changes with every revision. Customers with a data processing agreement are notified by email to their account administrators at least 30 days before a new subprocessor begins processing their data, and may object as set out in that agreement.
7. Contact Us
Questions about our subprocessors or data processing practices can be sent to our regulatory department:
Tychron Corporation
1201 N Orange St STE 7456
Wilmington, DE 19801-1293
Attn: Regulatory
Email: [email protected]