[ legal ]

Subprocessors

Last updated: June 17, 2026 (v2026-06-17)

Atol, Inc. uses the third-party sub-processors listed below to provide the Atol platform. These sub-processors process personal data on our behalf under written agreements that impose data protection obligations no less protective than those in our Data Processing Addendum.

We will update this page at least 14 days before adding a new sub-processor. Customers who have signed a DPA and registered an email address will be notified by email of material changes. You can object to a new sub-processor under the terms of the DPA.

Infrastructure and operational sub-processors

ServiceLegal entityCountryPurposePrivacy / DPA
Google Cloud PlatformGoogle LLCUnited StatesCloud infrastructure hosting (compute, managed databases, networking, object storage). Includes Cloud Spanner and Cloud SQL for OLTP storage.Policy
PostmarkWildbit LLC (an ActiveCampaign company)United StatesTransactional email delivery: beta waitlist confirmation emails, account notifications.Policy
Google reCAPTCHA EnterpriseGoogle LLCUnited StatesBot detection and spam prevention on public forms (subscribe, contact). Processes reCAPTCHA tokens submitted from user browsers.Policy
MaxMind GeoIP2MaxMind, Inc.United StatesIP geolocation and IP intelligence (VPN/proxy/Tor detection) used for device-risk scoring and fraud signals. Only IP addresses are processed; no personal data is sent to MaxMind servers -- the database is downloaded and queried locally.Policy

Notes

  • MaxMind database: The MaxMind GeoIP2 database is downloaded and stored on Atol's infrastructure. IP addresses are resolved locally -- they are not sent to MaxMind servers. Atol's use of the MaxMind database is governed by the MaxMind GeoIP2 End User License Agreement (ISC-licensed data files; commercial database subscription for enriched IP intelligence).
  • International transfers: All sub-processors listed above are headquartered in the United States. Transfers of EEA/UK personal data to these sub-processors are covered by Standard Contractual Clauses (SCCs) or, where applicable, adequacy decisions.
  • Customer-controlled processors: This list covers sub-processors engaged by Atol. If you integrate third-party services directly within your application (for example, your own email provider or analytics service), those are your own processors and are not listed here.

Contact

Questions about our sub-processors or to object to a new one under the DPA: privacy@atol.sh