Subprocessor List
Capitalized terms not defined here have the meaning given in Section Definitions or, where applicable, the executed Master Services Agreement.
About this list
This is the authoritative list of Sub-processors that may process Customer Data in connection with Section's delivery of the Services (Section Coach and SectionHQ). Section maintains this list for transparency in support of our Data Processing Addendum.
Website-visitor-only marketing processors (for example, Google Analytics and 6sense) are disclosed in the Privacy Policy and Cookie Statement, not on this list. HubSpot appears here because it also handles product-adjacent transactional and onboarding email tied to Customer accounts.
For each Sub-processor, the international transfer mechanism is the EU Standard Contractual Clauses, Module 3 (Processor-to-Processor), supplemented by the UK IDTA and the Swiss FADP where applicable.
How to subscribe to changes
Section provides at least thirty (30) days' notice before a new Sub-processor begins processing Customer Data, except where an unforeseen circumstance (such as a security incident, a material change in the functionality of the Services, or a compliance concern) requires an expedited change.
Customer administrators receive notifications of Sub-processor changes through two channels:
- In-product notice in the Section Coach and SectionHQ administrator consoles.
- Email notice to the administrative contacts on file for Customer's account.
Customers may also monitor updates to this page directly.
Sub-processors
| Sub-processor | Service Provided | Customer Data Categories | Location | Safeguards |
|---|---|---|---|---|
| Render Services, Inc. | Application hosting, managed PostgreSQL database, environment groups, platform-managed encryption | First name, last name, business email, authentication metadata, product event data, Customer Data submitted to the Services | United States (US-West, Oregon) | DPA; EU SCCs Module 3; UK IDTA; AES-256 at rest |
| OpenRouter, Inc. | LLM gateway; routes AI requests to Foundation Model providers under zero-retention contracts | Prompts and responses in transit only; no persistent storage of Customer-identifying content | United States | DPA; EU SCCs Module 3; zero-retention contract |
| OpenAI | Foundation Model provider (accessed via OpenRouter under zero-retention contract); generates AI responses | Prompts and responses in transit only; zero data retention; not used for model training | United States | Zero-retention contract via OpenRouter; EU SCCs Module 3 |
| Anthropic | Foundation Model provider (accessed via OpenRouter under zero-retention contract); generates AI responses | Prompts and responses in transit only; zero data retention; not used for model training | United States | Zero-retention contract via OpenRouter; EU SCCs Module 3 |
| Knock Labs, Inc. | Product transactional email and notifications | First name, last name, business email, notification content | United States | DPA; EU SCCs Module 3 |
| HubSpot, Inc. | Marketing email, product-adjacent onboarding email, CRM (also operates as a marketing processor on the Site) | First name, last name, business email, email engagement metadata | United States | DPA; EU SCCs Module 3 |
| Clerk, Inc. | Authentication, SSO (SAML / OIDC) brokerage, SCIM provisioning | First name, last name, business email, authentication metadata | United States | DPA; EU SCCs Module 3 |
| Rudderstack, Inc. | Event collection and routing for product analytics | First name, last name, business email, product event metadata | United States | DPA; EU SCCs Module 3 |
| Snowflake, Inc. | Analytics warehouse for product and customer analytics | First name, last name, business email, product event metadata | United States | DPA; EU SCCs Module 3 |
| Datadog, Inc. | Application monitoring, logging, error tracking, vulnerability management | Operational telemetry; application logs that may incidentally include End User identifiers | United States | DPA; EU SCCs Module 3 |
| Freshworks, Inc. (Freshdesk) | Customer support ticketing and issue resolution | First name, last name, business email, support ticket content | United States | DPA; EU SCCs Module 3 |
| Finch Technologies, Inc. | HRIS integration for SectionHQ (optional, only enabled by Customer) | Employee directory metadata: name, business email, manager, organizational structure | United States | DPA; EU SCCs Module 3 |
| Stripe, Inc. | Payment processing for Section Coach consumer billing only (enterprise is invoiced and not in scope) | Name, email, payment data handled by Stripe directly via Stripe Elements; Section does not store cardholder data | United States | DPA; EU SCCs Module 3; PCI-DSS handled by Stripe |
