The full list of vendors who may touch your data, what they do, where they sit, and which transfer mechanism covers cross-border data flows. 30 days' notice before any change.
Current sub-processors
The table below lists every sub-processor Highstone Media engages to deliver our services to clients, the purpose for which they are engaged, the categories of personal data they may process on a client's behalf, their primary processing location, and the transfer mechanism we rely on for cross-border transfers.
This list is incorporated by reference into our Data Processing Addendum. We update it whenever the list changes — see the change log below — and actively-engaged clients are notified by email at least 30 days before any addition or replacement.
| Provider | Purpose | Data categories | Location | Transfer |
|---|---|---|---|---|
| Google Workspace (Google LLC) | Business email, calendar, file storage, video meetings | Business contact information, message contents, files shared with us | United States (global infrastructure) | EU-US DPF / SCCs |
| Attio (Attio Ltd.) | CRM — prospect and client relationship management | Business contact information, engagement notes, conversation history | United Kingdom / EU | UK Addendum + EU SCCs to upstream US sub-processors |
| DocuSign (DocuSign, Inc.) | Contract execution and signatures | Signatory name, email, signature image, IP address at signing | United States | EU-US DPF / SCCs |
| Stripe (Stripe, Inc.) | Payment processing, invoicing | Billing contact, payment method metadata (not full card numbers), invoice records | United States (global) | EU-US DPF / SCCs |
| QuickBooks Online (Intuit Inc.) | Accounting and bookkeeping | Billing contact information, invoice and payment records | United States | SCCs |
| Plausible Analytics (Plausible Insights OÜ) | Website analytics — cookie-free, IP-hashed | Aggregated page-view counts, country-level approximate geography | Germany / EU | EU-based — no transfer mechanism needed for EEA controllers |
| Vercel Analytics (Vercel Inc.) | Page-load performance metrics — cookie-free | Aggregated web-vital metrics (LCP, INP, CLS), user agent | United States | EU-US DPF / SCCs |
| Vercel (Vercel Inc.) | Website hosting and CDN | Server logs (IP, user agent, request path) for security and operations | United States (edge globally) | EU-US DPF / SCCs |
| Cloudflare (Cloudflare, Inc.) | DNS, security, edge caching, bot management | IP address, user agent, request metadata (short-lived for security) | United States (edge globally) | EU-US DPF / SCCs |
| Slack (Slack Technologies, LLC) | Internal team messaging and (selectively) shared client channels | Messages, files, contact details of channel participants | United States | EU-US DPF / SCCs |
| Zoom (Zoom Video Communications, Inc.) | Video meetings (kickoffs, weekly reviews) | Meeting metadata; recordings only with consent of all participants | United States | EU-US DPF / SCCs |
| 1Password (AgileBits Inc.) | Internal credential management | Shared credentials for client systems we have admin access to | Canada | Adequacy (Canada PIPEDA recognised by EU) |
Notification of changes
When we add or replace a sub-processor, we will give at least 30 days' advance notice to active clients by email, unless the change is to address an urgent security incident.
If you object to a new sub-processor on reasonable data-protection grounds, contact privacy@highstonemedia.com within the notice period. If we cannot agree on an alternative within 30 days of your objection, either party may terminate the affected service without penalty under our DPA.
Advertising platforms — your own controllers
When we run paid media campaigns on your behalf, you remain the controller of the data sent to your own advertising platform accounts. The platforms below are not Highstone sub-processors; they are independent controllers or joint controllers with you, and each has its own privacy policy and data-processing terms that govern your relationship with it.
- Meta Platforms, Inc. (Facebook, Instagram)
- Google LLC (Google Ads, YouTube, GA4, Google Tag Manager)
- TikTok Pte. Ltd. (TikTok Ads, Business Center)
- Reddit, Inc.
- Pinterest, Inc.
- LinkedIn Corporation
- Measurement providers you elect (Northbeam, Triple Whale, Hyros, etc.) — engaged directly by you under their own terms.
Where Meta, Google, or TikTok act as joint controllers with you (e.g. Meta Custom Audience Terms), Highstone configures the integration on your behalf; you remain the controller for the purpose of your obligations to Data Subjects.
Change log
- 2026.05 — May 22, 2026
- Initial public publication of the sub-processor list and notice policy.
For a complete history of changes prior to this date, email privacy@highstonemedia.com.
Contact
To raise an objection, request the SCCs / DPA in force with a specific sub-processor, or ask anything else about this list, email privacy@highstonemedia.com or call +1 (360) 994-1062.