Snapshot 50778
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Subprocessors
Trust Center overview of standard subprocessors used in connection with CM.com
services
Version 7 May 2026
Scope Connect & Engage, Live, Pay and other CM.com services
Purpose Public-facing overview for customers, prospects and auditors
This document lists the standard subprocessors used by CM.com under the CM.com Terms and
Conditions and applicable Data Processing Addendum. The list is organized by service.
• Each table identifies the relevant subprocessor, its main establishment or registered office, the role
it performs, the applicable processing location(s) and the transfer mechanism used by CM.com.
• Processing locations are described at regional level where underlying cloud or network resilience
may involve multiple data centers or points of presence within the stated region.
• Optional features are marked where the relevant subprocessor only applies if the customer enables
or uses that feature.
• References to CM.com Affiliates cover CM.com group companies involved in support or delivery of
the relevant service within the EEA, as further described on the CM.com Trust Center.
Connect & Engage
Messaging, engagement and AI-enabled customer interaction services.
Appmiral
Used for cloud services, analytics, API monitoring and network security.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the the Agreement
EEA where applicable)
United States and
101 Townsend Street, San global edge network DPA, Standard
Network
Cloudflare, Inc. Francisco, CA 94107, United (including EU/EEA contractual
security
States points of presence clauses
where traffic is routed)
EU/EEA, primarily
Google Ireland Gordon House, Barrow Street,
Analytics Google Cloud regions in DPA
Ltd. Dublin 4, D04 E5W5, Ireland
the Netherlands.
DPA, Standard
620 8th Avenue, 45th Floor, New Monitoring API
Datadog, Inc. United States contractual
York, NY 10018, United States traffic
clauses
EU/EEA, primarily AWS
Amazon Web
38 Avenue John F. Kennedy, L- regions in the
Services EMEA Cloud services DPA
1855 Luxembourg, Luxembourg Netherlands and
SARL
Germany.
Conversational AI Cloud
Used for the provision of the Conversational AI Cloud service, including hosting, platform security and support
functions.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 Support,
CM.com Affiliates BD Breda, The Netherlands (and performance of EU/EEA DPA
other group establishments the Agreement
within the EEA where applicable)
One Microsoft Place, South EU/EEA, primarily
Microsoft Ireland Azure
County Business Park, Microsoft Azure
Operations Hosting/Cloud DPA
Leopardstown, Dublin 18, D18 regions in the
Limited Services
P521, Ireland Netherlands
United States and
101 Townsend Street, San global edge network DPA, Standard
Cloudflare, Inc. Francisco, CA 94107, United Network security (including EU/EEA contractual
States points of presence clauses
where traffic is routed)
Conversational Channels
Used for traffic routing, security and operational support of channel integrations, such as WhatsApp Business,
RCS, Viber and Facebook Messenger.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of EU/EEA DPA
Affiliates
group establishments within the the Agreement
EEA where applicable)
Cloudflare, Inc. United States and
(Optional Global Load balancing global edge network DPA, Standard
See vendor corporate details /
endpoint, & Network (including EU/EEA contractual
registered office
please see our security points of presence clauses
developer docs) where traffic is routed)
Conversational Router
Used to route messages and provide the associated cloud infrastructure.
Main establishment or registered Processing Transfer
Subprocessor Role in the service
office location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of the EU/EEA DPA
Affiliates
group establishments within the EEA Agreement
where applicable)
EU/EEA, primarily
Google Ireland Gordon House, Barrow Street, Cloud hosting and Google Cloud
DPA
Ltd. Dublin 4, D04 E5W5, Ireland services provider regions in the
Netherlands
Customer Data Platform
Used for hosting and operation of the customer data platform environment.
Main establishment or registered Processing Transfer
Subprocessor Role in the service
office location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of the EU/EEA DPA
Affiliates
group establishments within the EEA Agreement
where applicable)
EU/EEA, primarily
Google Ireland Gordon House, Barrow Street, Cloud hosting and Google Cloud
DPA
Ltd. Dublin 4, D04 E5W5, Ireland services provider regions in the
Netherlands
HALO
Used for hosting, network security and AI-related processing features such as redaction and inference
support.
Main establishment or Processing Transfer
Subprocessor Role in the service
registered office location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of the EU/EEA DPA
group establishments within the Agreement
EEA where applicable)
EU/EEA, primarily
Microsoft Ireland One Microsoft Place, South County
Azure Hosting/Cloud Microsoft Azure
Operations Business Park, Leopardstown, DPA
Services regions in the
Limited Dublin 18, D18 P521, Ireland
Netherlands
United States and
global edge
101 Townsend Street, San network DPA, Standard
Cloudflare, Inc. Francisco, CA 94107, United Network security (including EU/EEA contractual
States points of clauses
presence where
traffic is routed)
EU/EEA, primarily
Personal information
Google Ireland Gordon House, Barrow Street, Google Cloud
redaction; Vertex AI DPA
Ltd. Dublin 4, D04 E5W5, Ireland regions in the
Platform
Netherlands
AI-based text-to-
speech
services, converting DPA, Standard
Elevenlabs, Inc. 169 Madison Ave #2484, New York,
text United states contractual
(Optional) NY 10016, United States
input into synthesized clauses
speech audio for voice
output functionalities.
Identity
Used for service support and performance of the agreement.
Main establishment or registered Processing Transfer
Subprocessor Role in the service
office location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD
CM.com Support, performance of
Breda, The Netherlands (and other EU/EEA DPA
Affiliates the Agreement
group establishments within the EEA
where applicable)
Inspire
Used for platform hosting and cloud support.
Main establishment or registered Role in the Processing Transfer
Subprocessor
office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the EEA the Agreement
where applicable)
EU/EEA, primarily
Microsoft Ireland One Microsoft Place, South County Azure
Microsoft Azure
Operations Business Park, Leopardstown, Dublin Hosting/Cloud DPA
regions in the
Limited 18, D18 P521, Ireland Services
Netherlands
Wognumsebuurt 3, 1817 BH Alkmaar,
CYSO B.V. Cloud Support EU/EEA DPA
The Netherlands
Mobile Identity
Used to provide mobile identity services through operator connections.
Main establishment or registered Processing Transfer
Subprocessor Role in the service
office location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of the EU/EEA DPA
group establishments within the EEA Agreement
where applicable)
Provision of mobile
Devonshire House, Manor Way,
Sekura Mobile identity services via United
Borehamwood, Hertfordshire, WD6 DPA
Intelligence, Ltd. operator Kingdom
1QQ, United Kingdom
connections
Mobile Marketing Cloud
Used for campaign support and, where enabled, email delivery or email validation services.
Main establishment or registered Role in the Processing Transfer
Subprocessor
office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other group performance of EU/EEA DPA
establishments within the EEA where the Agreement
applicable)
Email delivery DPA, Standard
(Optional) 1801 California Street, Suite 500,
(Email United States contractual
SendGrid, Inc. Denver, CO 80202, United States
Campaigns) clauses
(Optional) Hertza DPA, Standard
10 E Yanonali Street, Santa Barbara, CA Email validation
L.L.C. United States contractual
93101, United States service
(ZeroBounce) clauses
Mobile Service Cloud
Used for ticketing and service workflows, including optional email, support and co-browsing features.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the the Agreement
EEA where applicable)
EU/EEA, primarily
One Microsoft Place, South County Azure
Microsoft Ireland Microsoft Azure
Business Park, Leopardstown, Hosting/Cloud DPA
Operations Limited regions in the
Dublin 18, D18 P521, Ireland Services
Netherlands
2400 Market Street, No. 200, Suite DPA, Standard
Inbound email
Wildbit LLC 235B, Philadelphia, PA 19103, United States contractual
parsing
United States clauses
Email delivery DPA, Standard
1801 California Street, Suite 500,
SendGrid, Inc. (Email United States contractual
Denver, CO 80202, United States
Campaigns) clauses
DPA, Standard
1745 Peachtree Street NE, Suite N, Support,
Fullstory, Inc. United States contractual
Atlanta, GA 30309, United States debugging
clauses
OBI4wan B.V.
(Only for Clients Korte Hogendijk 2, 1506 MA
Custom channels The Netherlands DPA
connected before Zaandam, The Netherlands
30 June 2023)
Singel 373C, 1012 WL Amsterdam,
Surfly B.V. Co-browse The Netherlands DPA
The Netherlands
DPA, Standard
51 Pleasant Street, #1020, Malden,
MaxMind, Inc. Digital mapping United States contractual
MA 02148, United States
clauses
Sign
Used to host signing workflows and, where enabled, signed dossiers.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the EEA the Agreement
where applicable)
EU/EEA, primarily
(Optional) Microsoft One Microsoft Place, South County Azure
Microsoft Azure
Ireland Operations Business Park, Leopardstown, Hosting/Cloud DPA
regions in the
Limited Dublin 18, D18 P521, Ireland Services
Netherlands
EU/EEA, primarily
(Optional) Google Gordon House, Barrow Street, Cloud storage of Google Cloud
DPA
Ireland Ltd. Dublin 4, D04 E5W5, Ireland signed dossiers. regions in the
Netherlands
SMS
Used for traffic routing, security and support of messaging services.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of the EU/EEA DPA
group establishments within the EEA Agreement
where applicable)
United States and
Cloudflare, Inc.
global edge DPA,
(Optional Global
See vendor corporate details / Load balancing & network (including Standard
endpoint, please
registered office Network security EU/EEA points of contractual
see our developer
presence where clauses
docs)
traffic is routed)
Tracedock
Used for cloud hosting and logging of the Tracedock service.
Main establishment or registered Role in the Processing Transfer
Subprocessor
office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the EEA the Agreement
where applicable)
EU/EEA, primarily
Amazon Web
38 Avenue John F. Kennedy, L-1855 Cloud hosting AWS regions in the
Services EMEA DPA
Luxembourg, Luxembourg and Logging Netherlands and
SARL
Germany
Verification as a Service
Used for support of the service and, where email OTP is enabled, the subprocessors listed under Mobile
Marketing Cloud.
Main establishment or registered Role in the Processing Transfer
Subprocessor
office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com Affiliates Breda, The Netherlands (and other performance of EU/EEA DPA
group establishments within the EEA the Agreement
where applicable)
Subprocessors listed
under “Mobile Marketing See vendor corporate details /
- - -
Cloud” (Optional if email registered office
OTP is enabled)
Voice
Used for voice traffic security, optional AI services and optional transcription features.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated
group entities, Konijnenberg 30,
Support,
4825 BD Breda, The
CM.com Affiliates performance of EU/EEA DPA
Netherlands (and other group
the Agreement
establishments within the EEA
where applicable)
United States and
Cloudflare, Inc. global edge network
Load balancing DPA, Standard
(Optional Global See vendor corporate details / (including EU/EEA
& Network contractual
endpoint, please see registered office points of presence
security clauses
our developer docs) where traffic is
routed)
One Microsoft Place, South EU/EEA, primarily
(Optional) Microsoft
County Business Park, Microsoft Azure
Ireland Operations Azure AI Services DPA
Leopardstown, Dublin 18, D18 regions in the
Limited
P521, Ireland Netherlands
EU/EEA, primarily
(Optional) Amazon Transcriptions
38 Avenue John F. Kennedy, L- AWS regions in the
Web Services EMEA for Voice API DPA
1855 Luxembourg, Luxembourg Netherlands and
SARL services
Germany
Transcriptions EU/EEA, primarily
(Optional) Google Gordon House, Barrow Street,
for Voice API Google Cloud regions DPA
Ireland Ltd. Dublin 4, D04 E5W5, Ireland
services in the Netherlands
Live
Event, ticketing and venue-related services.
CM.com Ticketing Platform
Used for hosting, email delivery and network security for the ticketing platform.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of EU/EEA DPA
Affiliates
group establishments within the the Agreement
EEA where applicable)
United States and
global edge network DPA, Standard
101 Townsend Street, San Network
Cloudflare, Inc. (including EU/EEA contractual
Francisco, CA 94107, United States security
points of presence clauses
where traffic is routed)
Cloud hosting EU/EEA, primarily
Google Ireland Gordon House, Barrow Street,
and services Google Cloud regions in DPA
Ltd. Dublin 4, D04 E5W5, Ireland
provider Europe
DPA, Standard
1801 California Street, Suite 500,
SendGrid, Inc. Email delivery United States contractual
Denver, CO 80202, United States
clauses
Museums & Parks
Used for hosting, analytics, email delivery and network security.
Main establishment or Processing Transfer
Subprocessor Role in the service
registered office location(s) mechanism
CM.com N.V. and affiliated
group entities, Konijnenberg 30,
Support,
4825 BD Breda, The Netherlands
CM.com Affiliates performance of the EU/EEA DPA
(and other group establishments
Agreement
within the EEA where
applicable)
One Microsoft Place, South
Microsoft Ireland Azure EU/EEA, primarily
County Business Park,
Operations Hosting/Cloud Microsoft Azure DPA
Leopardstown, Dublin 18, D18
Limited Services regions in Europe
P521, Ireland
United States and
global edge network
101 Townsend Street, San DPA, Standard
(including EU/EEA
Cloudflare, Inc. Francisco, CA 94107, United Network security contractual
points of presence
States clauses
where traffic is
routed)
1801 California Street, Suite DPA, Standard
Email delivery
SendGrid, Inc. 500, Denver, CO 80202, United United States contractual
(Email Campaigns)
States clauses
Google EU/EEA, primarily
Google Ireland Gordon House, Barrow Street,
Analytics/Hosting & Google Cloud regions DPA
Ltd. Dublin 4, D04 E5W5, Ireland
Cloud services in Europe
Yourticketprovider Platform
Used for hosting, email delivery and network security.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 Support,
CM.com Affiliates BD Breda, The Netherlands (and performance of EU/EEA DPA
other group establishments the Agreement
within the EEA where applicable)
One Microsoft Place, South
Microsoft Ireland Azure EU/EEA, primarily
County Business Park,
Operations Hosting/Cloud Microsoft Azure DPA
Leopardstown, Dublin 18, D18
Limited Services regions in Europe
P521, Ireland
United States and
101 Townsend Street, San global edge network DPA, Standard
Cloudflare, Inc. Francisco, CA 94107, United Network security (including EU/EEA contractual
States points of presence clauses
where traffic is routed)
Amazon Web
38 Avenue John F. Kennedy, L- EU/EEA, primarily AWS
Services EMEA Email delivery DPA
1855 Luxembourg, Luxembourg Europe regions
SARL
Pay
Payments and commerce-related services.
Online Payments
Used for hosting and network security of online payments services.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of EU/EEA DPA
Affiliates
group establishments within the the Agreement
EEA where applicable)
United States and
global edge network DPA, Standard
101 Townsend Street, San Network
Cloudflare, Inc. (including EU/EEA contractual
Francisco, CA 94107, United States security
points of presence clauses
where traffic is routed)
Cloud hosting EU/EEA, primarily
Google Ireland Gordon House, Barrow Street,
and services Google Cloud regions in DPA
Ltd. Dublin 4, D04 E5W5, Ireland
provider Europe
POS Payments
Used for hosting of point-of-sale payment services.
Main establishment or registered Role in the Processing Transfer
Subprocessor
office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Breda, Support,
CM.com
The Netherlands (and other group performance of EU/EEA DPA
Affiliates
establishments within the EEA where the Agreement
applicable)
Cloud hosting EU/EEA, primarily
Google Ireland Gordon House, Barrow Street, Dublin 4,
and services Google Cloud DPA
Ltd. D04 E5W5, Ireland
provider regions in Europe
Miscellaneous
Residual service category where no specific service table is listed elsewhere in this document.
Other CM.com Services (if not specified above)
Used for support and performance of the agreement where no service-specific subprocessor list is stated
above.
Role in the Processing Transfer
Subprocessor Main establishment or registered office
service location(s) mechanism
CM.com N.V. and affiliated group entities,
Konijnenberg 30, 4825 BD Breda, The Support,
CM.com
Netherlands (and other group performance of EU/EEA DPA
Affiliates
establishments within the EEA where the Agreement
applicable)
General subprocessors applicable to all services
The subprocessors listed below are generally applicable across CM.com services and may be used in
connection with the delivery, security and operational continuity of such services, unless a specific service
description states that the relevant subprocessor is optional for that service.
Main establishment or Role in the Processing Transfer
Subprocessor
registered office service location(s) mechanism
CM.com N.V. and affiliated group
entities, Konijnenberg 30, 4825 BD Support,
CM.com
Breda, The Netherlands (and other performance of EU/EEA DPA
Affiliates
group establishments within the the Agreement
EEA where applicable)
United States and
Network global edge network DPA, Standard
101 Townsend Street, San
Cloudflare, Inc. security and (including EU/EEA contractual
Francisco, CA 94107, United States
availability points of presence clauses
where traffic is routed)
Additional notes
• Where a processing location is stated as EU/EEA, the relevant service is intended to be hosted or
processed from infrastructure located within the European Union or European Economic Area.
• Where a subprocessor operates global network infrastructure, traffic or limited service metadata
may transit through multiple regions to ensure availability, security and performance.
• For a detailed overview of CM.com group entities, please refer to the CM.com Trust Center privacy
page.