Sub-processors

Third parties that process customer personal data on Carriyo's behalf.

Last updated: 2026-10-29

Carriyo uses a limited number of sub-processors to deliver its services. Sub-processors are assessed under our Supplier Security Policy and are bound by contractual data protection obligations. This list is published from Carriyo's sub-processor register (version 2.5).

Sub-processor

Service

Data processed

Location

Certifications

Amazon Web Services (incl. AWS Cognito)

Cloud infrastructure & hosting; identity/authentication (AWS Cognito)

Customer shipping data, order data, PII

Ireland (eu-west-1), multi-AZ; no replica outside eu-west-1 today (multi-region offered, deployed for no customer); hosting locations may change

SOC 2, ISO 27001, CSA STAR

Twilio/SendGrid

Email notifications

Customer email addresses, order notifications

United States

SOC 2, ISO 27001

Zendesk

Customer support / ticketing

Customer support interactions; may include customer contact data/PII

United Kingdom

SOC 2, ISO 27001

Stripe

Payment processing

Payment/billing data; holds PII

Not specified

PCI DSS Level 1, SOC 2, ISO 27001

SMS Country

SMS / mobile notifications

Customer mobile numbers, order/delivery notifications

India, Saudi Arabia, Qatar, Oman

To be assessed

Google Cloud Platform (BigQuery)

Analytics data store for the Carriyo Intelligence module (reporting and analytics on shipment, order, return, notification, feedback and product data)

Pseudonymised personal data of consignees and senders: direct identifiers HMAC-SHA256-hashed at load (key in AWS Secrets Manager); address lines, building, postcode, city, country and coordinates in clear; customer hash as the join key

United Kingdom (europe-west2, London)

ISO 27001, SOC 2

Change notification

This list is the current record of our sub-processors and is kept up to date as they change. Questions about it go to security@carriyo.com.