Sub-Processor List and International Access Disclosure

Authenticating.com LLC · Version 1.0 · Effective November 11, 2026 · Prior versions

Authenticating.com LLC engages the third parties below to process personal information in connection with our Services. Each is bound by written agreement to data protection obligations consistent with our Data Processing Agreement.

We give customers thirty (30) days' notice by email to their designated contact before adding or replacing a Sub-Processor. Customers may object on reasonable data protection grounds within fifteen (15) days, as set out in Section 5.2 of our Data Processing Agreement.

1. INFRASTRUCTURE AND HOSTING

Sub-ProcessorPurposeProcessing location
Amazon Web ServicesCloud hosting and storageUnited States — us-east-1, us-west-1

2. VERIFICATION AND DATA PROVIDERS

Sub-ProcessorPurposeProcessing location
GBG / Acuant / IDologyIdentity and document verificationUnited States
Thomson ReutersIdentity and public records dataUnited States
TransUnionIdentity data and knowledge-based authenticationUnited States
EquifaxIdentity and verification dataUnited States
MastercardFinancial account ownership verificationUnited States
SambaSafetyMotor vehicle recordsUnited States
National Student ClearinghouseEducation verificationUnited States
CICCriminal and court recordsUnited States
InformDataCriminal and court recordsUnited States
FideoIdentity dataUnited States

3. BUSINESS AND SUPPORT TOOLING

Sub-ProcessorPurposeProcessing location
HubSpotCustomer support and customer relationship managementUnited States
DatadogApplication monitoringUnited States
MixpanelProduct analyticsUnited States
GoogleEmail and file storageUnited States
AnthropicAI-assisted processingUnited States

4. PERSONNEL AND CONTRACTED SERVICE PROVIDERS

EntityPurposeLocation
Independent contractors providing engineering, operations and support servicesDevelopment, maintenance, monitoring and support of the ServicesIndia

5. INTERNATIONAL ACCESS

Personal information is stored in the United States. Personal information may be accessed remotely from the jurisdictions listed above, including India, by personnel and Sub-Processors providing engineering, operations and support services.

All such access is:

  • limited to the minimum personal information necessary, on a role-based least-privilege basis;
  • through a controlled environment with multi-factor authentication and no persistent local copies;
  • logged and monitored;
  • subject to a prohibition on downloading, locally storing, printing or exporting personal information outside our controlled environment; and
  • governed by written confidentiality and data protection agreements.

Where personal information originates from the European Economic Area, the United Kingdom or Switzerland, we rely on the EU Standard Contractual Clauses (Modules Two and Three as applicable) and the UK International Data Transfer Addendum, supported by a Transfer Impact Assessment for each recipient jurisdiction. Those clauses are flowed down to each Sub-Processor and contractor with access to such information.

6. BIOMETRIC DATA

Biometric identifiers and source photographs are subject to the same access controls set out in Section 5, and additionally to detailed logging of every access to biometric systems. Biometric data is never transferred outside our controlled environment and is destroyed on the schedule set out in our Biometric Policy.

7. CHANGES

We update this list when a Sub-Processor is added, removed, or changes its processing location. Customers receive notice as described above. Questions: privacy@authenticating.com.

Prior versions

This is the first published version of this document. When it is updated, prior versions will be archived here.