Introduction
Biqli uses, or may use when the relevant feature is enabled, the approved providers below to operate, secure, support, contract for, and bill the Services. A provider is a subprocessor only when it actually processes Customer Personal Data on Biqli's behalf. Some payment, identity, or customer-directed integration providers may act as independent controllers for their own legal, fraud, or compliance purposes.
Notification of Changes
We will keep this page current. For Enterprise Customers, Biqli will provide at least 30 days notice before a new subprocessor begins materially processing Customer Personal Data. If an immediate replacement is reasonably required to avoid material security, continuity, or legal harm and advance notice is not reasonably possible, Biqli will give notice without undue delay, explain the reason, and preserve the objection rights described in the DPA.
Approved Providers
| Provider | Purpose | Data and location | Privacy reference |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, DDoS protection, image delivery, and edge security | Network, IP, request, and cached content data; global infrastructure | Cloudflare DPA |
| Amazon Web Services, Inc. | Object storage and supporting cloud infrastructure where enabled | Files, backups, and service metadata; selected AWS regions | AWS DPA |
| Upstash, Inc. | Managed Redis, queues, caching, and temporary integration state where enabled | Session identifiers, job and cache data; configured region | Upstash DPA |
| Zoho Corporation | Transactional and support email | Names, email addresses, message content, and delivery metadata; configured data center | Zoho privacy |
| Functional Software, Inc. (Sentry) | Error monitoring and application diagnostics | Diagnostic, request, device, and error data; United States and provider infrastructure | Sentry DPA |
| SignWell | Electronic signatures and contract audit trails | Signer identity, email, document, signature, IP, timestamp, and audit data; United States | SignWell privacy |
| Google LLC | Authentication, analytics APIs, URL safety, and customer-directed Google integrations | Account identifiers, URLs, request, security, and integration data; global infrastructure | Google Cloud DPA |
| Stripe, Inc. | Payment processing, invoicing, tax and fraud controls | Billing contact, payment, invoice, device, and fraud data; global infrastructure | Stripe DPA |
| PayPal group companies | Alternative payments and payout services where selected | Identity, contact, transaction, payment, and compliance data; global infrastructure | PayPal privacy |
Customer-directed services such as Shopify, an identity provider, a webhook destination, or a custom domain provider are not Biqli subprocessors merely because Customer chooses to connect them. Their own terms and privacy notices apply to their processing.
Data Protection Measures
Before a provider materially processes Customer Personal Data, Biqli evaluates its security and privacy practices and enters written terms appropriate to the service. Subprocessors must protect data consistently with Biqli's DPA. Biqli remains responsible for a subprocessor's performance of its subprocessing obligations.
Your Rights
An Enterprise Customer may object to a new subprocessor on reasonable data-protection grounds during the notice period. The parties will work in good faith on a reasonable alternative. If none is available, the Customer may terminate the affected Service before the new subprocessor begins, as provided in the DPA.
International Data Transfers
Providers may process data outside Customer's country. Where required, Biqli uses adequacy decisions, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, Swiss adaptations, transfer assessments, and supplementary technical or contractual safeguards as described in the DPA.
Contact Us
Questions about a provider or change notice may be sent to contact@biq.li.