Sub-processors
Last updated: May 2026.
Aclamos uses the third-party services below to deliver the platform. We notify Customers of sub-processor changes at least 30 days in advance via email and via the public changelog. Customers may object during that window; we will work in good faith to provide an alternative or, failing that, allow termination per the DPA.
To subscribe to sub-processor change notifications email dpa@aclamos.app.
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|---|---|---|---|
| Railway, Inc. policy | Application hosting + Postgres + Redis | All Customer Data | US-East · EU-West · AU-Sydney (one chosen per Customer org) | EU SCCs (Module 2) where applicable |
| Cloudflare, Inc. policy | Object storage (R2) + Turnstile bot prevention + WAF/CDN | Uploads, file thumbnails, request metadata | US, EU | EU SCCs · DPF |
| Amazon Web Services, Inc. policy | Optional alternative object storage (S3) for customers who prefer it | Uploads, file thumbnails | Customer-selected | EU SCCs · DPF |
| Stripe, Inc. policy | Payments + Stripe Connect for direct-to-organization payouts | Card holder name, last-4, billing email; full PAN never reaches Aclamos | US (with EU sub-processors) | EU SCCs · DPF |
| SMTP2GO Pty Ltd policy | Transactional email (sign-in magic links, receipts, judge invites, winner emails) | Recipient email, message body, send metadata | US, EU, AU | EU SCCs |
| Twilio, Inc. policy | SMS for phone-OTP and reminder cadence (Ballotis) | Phone number, message body, delivery metadata | US (with global carriers) | EU SCCs · DPF |
| Anthropic, PBC policy | AI features (Claude) — eligibility, briefs, summaries, plagiarism, fraud detection | Prompt + response payloads. Zero-retention; not used to train models. | US | EU SCCs · DPF |
| Google LLC policy | Maps Places API (address autocomplete, proxied server-side) | Address strings the user types into a form | US | EU SCCs · DPF |
| Mailchimp / Intuit, Inc. policy | Optional sender for guest comms (when the producer connects it) | Recipient email, message body | US | EU SCCs · DPF |
Categories of recipients
Beyond sub-processors, Aclamos may also share Customer Data with: (a) authorized employees and contractors of Aclamos who need it to provide the Services; (b) the Customer's own users (e.g. judges seeing nominations); (c) law enforcement or courts as required by law, with notice to the Customer where permitted; (d) acquirers in the event of a merger, acquisition, or sale of substantially all assets, subject to the same protections.
International transfers
Where Customer Data is transferred from the EEA, UK, or Switzerland to the United States or another non-adequate country, Aclamos relies on the EU Standard Contractual Clauses (2021, Module 2) and, where applicable, the UK Addendum and the EU-US / Swiss-US Data Privacy Framework. Full text in the DPA.