Sub-Processors
List of third parties that may process customer or merchant data on behalf of Chainmore OÜ. Maintained pursuant to GDPR Article 28(2). Updated when a sub-processor is added or replaced; merchants may subscribe to change notifications via support@chainmore.io.
Active sub-processors
These are the sub-processors that may currently process customer, merchant, or public-site visitor data on behalf of Chainmore OÜ. The Concierge processor below processes data only when the Concierge is enabled and a visitor chooses to use it.
| Sub-processor | Purpose | Data category | Region | Transfer mechanism |
|---|---|---|---|---|
| Netlify, Inc. | Static hosting and CDN for the public marketing site (chainmore.io), its public legal pages, and the public waitlist form handler. ChainMore does not send production merchant dashboard, gateway, internal-operations, or end-customer payment data to Netlify. |
Website visitor logs (IP address, user-agent, requested URL) and waitlist form submissions (work email address plus technical form metadata). | United States | EU-US Data Privacy Framework where active for the relevant entity, EU SCCs Module 2 as fallback. DPF status verified at each annual review. |
| OpenAI, L.L.C. | Generation of responses for the optional ChainMore Concierge on the public website. The Concierge is not used for account support, confidential documents, credentials, private keys, or payment secrets. | Visitor-entered chat text for Concierge questions. ChainMore does not store Concierge chat transcripts or link them to merchant accounts. | United States | EU Standard Contractual Clauses under the applicable data-processing terms. |
Additional processor categories for merchant product surfaces
As merchant product surfaces move through early-access and production processing, ChainMore discloses selected sub-processors through the merchant DPA process and this public list. Before a new sub-processor begins processing production merchant personal data, the Processor will give merchants 14 calendar days' written notice with the full vendor row added to the active list.
The categories below are forward-looking statements about the operating model the Processor intends to build. They are not commitments to any specific vendor.
| Category | Function the Processor expects to outsource | Region preference | Mitigations before activation |
|---|---|---|---|
| Production hosting | Compute and managed-service hosting for the merchant dashboard, gateway API, and identity provider. | EU preferred (Frankfurt or equivalent) | At-rest encryption confirmed in the chosen provider's terms, GDPR-compliant DPA executed, SCCs Module 2 attached for any non-EEA fallback. |
| Transactional email | Outbound merchant emails: account verification, password reset, webhook-delivery alerts. | EU preferred | DKIM, SPF, DMARC alignment under chainmore.io, bounce-and-suppression handling enabled, audit trail of dispatched messages retained. |
| Error tracking | Frontend and backend exception tracking for incident response. | EU preferred | Server-side PII scrubbing configured before any event leaves Processor infrastructure, scrubbing rule-set reviewed annually. |
| Operational database | Primary OLTP database for merchant data, gateway state, and audit-log storage. | EU preferred | At-rest encryption, TLS in transit, point-in-time recovery enabled. |
What we don't use
For transparency, ChainMore explicitly does not use the following classes of services on customer-facing surfaces:
- Behavioural advertising or retargeting trackers (Google Ads, Meta Pixel, etc.).
- Third-party web-analytics tools that use tracking cookies (Google Analytics, Adobe Analytics, etc.). If we add analytics later, it will be a privacy-preserving option (Plausible, Fathom, or similar) and will appear on this list.
- Customer-data brokers, data-enrichment services, or lead-scoring vendors.
- Chat widgets that load third-party scripts on the marketing site. The optional ChainMore Concierge uses first-party site code and the server-side sub-processor listed above.
Sub-processor change notification
Per GDPR Article 28(2), ChainMore will give merchants prior written notice of any intended changes to this list. Notice mechanism, once production merchants are onboarded:
- Email to the merchant's primary contact at least 14 days before the new sub-processor begins processing.
- Update to this page on the same day the email is sent.
- An announcement in the merchant dashboard's status banner for at least 7 days after the change takes effect.
Merchants may object to a new sub-processor in writing within the 14-day window. If we cannot accommodate the objection (for example, the sub-processor is on a critical infrastructure path), the merchant may terminate the agreement without penalty.
How to verify this page is current
The page footer carries a "Last updated" date. The canonical URL is https://chainmore.io/legal/sub-processors.html. The Processor maintains an internal change-log alongside the source-of-truth annex; controllers receive a copy as part of their DPA pack and are notified of any change before it takes effect.
Last updated: July 2026 · Questions: support@chainmore.io