Security & Trust
Sub-processors
The third parties that process customer data on our behalf in order to run Landing Platform — what each one does, and where it operates. Published in full so you can assess it without asking.
Last updated: 27 August 2026
Notice of changes. We give at least 30 days' notice before adding or replacing a sub-processor, with a right to object on reasonable data-protection grounds. To be told when this list changes, email privacy@pivotal.digital and we will add you.
Processing customer data on our behalf
These are engaged by us and covered by our Data Processing Agreement. Each is bound by written terms imposing obligations equivalent to our own, and we remain responsible for their performance.
| Provider | What it does | Where |
|---|---|---|
| OVH | Application hosting, database, file storage and backups | European Economic Area (France) |
| OVH | Analytics and search infrastructure, reachable only from our own servers | United Kingdom |
| Amazon Web Services | Campaign email delivery, and the server-side meeting notetaker where enabled | European Union (Ireland) |
| Cloudflare | Object storage and delivery for recordings, attachments and media | Cloudflare global network |
| Resend | Transactional email — invitations, password resets, notifications | United States |
| Twilio | SMS notifications, two-factor codes and voice calls | United States |
| Twilio SendGrid | Inbound email processing for reply handling | United States |
| Anthropic | AI features — content generation, analysis and assistance | United States |
| OpenAI | Speech-to-text for meeting recordings and voice notes | United States |
| Image and video generation for creative features | United States | |
| ElevenLabs | Text-to-speech for course narration and assistant voice | United States |
| Apollo | Business contact enrichment, where the feature is used | United States |
| ipapi | Reverse-IP company lookup for visitor analytics | European Union (Austria) |
| Google reCAPTCHA | Bot protection on public forms | United States |
| Apple | Push notifications to the iOS app | United States |
Transfers into the European Economic Area rely on the UK's adequacy regulations. Transfers further afield run on Standard Contractual Clauses with the UK Addendum, together with any supplementary measures identified in a transfer risk assessment.
Services you connect yourself
These are not our sub-processors. You connect them with your own account and credentials, and your relationship with each is your own — we simply pass data where you tell us to.
Microsoft 365 and Google Workspace (sending as you, and calendar), Meta, LinkedIn, TikTok and X for social publishing, Google Ads, Xero, Shopify, Klaviyo, Mailchimp, ClickUp, Sage HR, Synergist, Street, Convert.com — and any tracking pixels you choose to configure on your own pages.
Independent controllers
These handle payment data under their own terms and privacy notices rather than on our instruction.
Stripe and PayPal.
Questions about anything on this list, or about a provider you would rather we did not use? Email privacy@pivotal.digital. See also our security overview and privacy policy.