# GoCardless

GoCardless (gocardless.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/gocardless
- Documents last verified: 2026-10-02
- Transparency rating: 75/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 18 tracked vendors directly, 111 within two hops, 360 within three; 5 tracked vendors rely on it directly, 24 within two hops, 351 within three
- Cite as: GoCardless, Third Party Index, https://thirdpartyindex.com/vendors/gocardless (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Subprocessor list | https://assets.ctfassets.net/40w0m41bmydz/wpMSi6LE6J3Ih8i5G4gGU/68e83f454d32aaf16175821b7e031b07/GoCardless\_material\_supplier\_list\_v2026.06.pdf | 2026-10-02 | 2026-10-02 |
| Privacy policy | https://gocardless.com/privacy/merchants | 2026-10-02 | 2026-10-02 |
| Security page | https://gocardless.com/security | 2026-10-02 | 2026-10-02 |
| security.txt | https://gocardless.com/.well-known/security.txt | 2026-10-02 | 2026-10-02 |
| Status page | https://www.gocardless-status.com/ | 2026-10-02 | 2026-10-02 |

## Subprocessors (23)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | IT | EU-West region | 2026-10-02 |
| [Braze](https://thirdpartyindex.com/vendors/braze.md) | Comms | United States | 2026-10-02 |
| [Celigo](https://thirdpartyindex.com/vendors/celigo.md) | Partner connection | Germany | 2026-10-02 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | IT | United States | 2026-10-02 |
| [Dun & Bradstreet](https://thirdpartyindex.com/vendors/dun-and-bradstreet.md) | Credit | United Kingdom | 2026-10-02 |
| Finastra Limited | Payment processing | United Kingdom | 2026-10-02 |
| [Flagright](https://thirdpartyindex.com/vendors/flagright.md) | Compliance | United Kingdom | 2026-10-02 |
| [Form3](https://thirdpartyindex.com/vendors/form3.md) | Payment processing | United Kingdom | 2026-10-02 |
| [GitHub](https://thirdpartyindex.com/vendors/github.md) | IT | United States | 2026-10-02 |
| [Google](https://thirdpartyindex.com/vendors/google-cloud.md) | IT | Netherlands | 2026-10-02 |
| [LexisNexis Risk Solutions](https://thirdpartyindex.com/vendors/lexisnexis.md) | Compliance | United States | 2026-10-02 |
| [Looker](https://thirdpartyindex.com/vendors/looker.md) | Business intelligence | United States | 2026-10-02 |
| Mastercard Payment Services | Payment processing | Denmark | 2026-10-02 |
| [Okta](https://thirdpartyindex.com/vendors/okta.md) | IT | United States | 2026-10-02 |
| Onfido | Compliance | United Kingdom | 2026-10-02 |
| [Provenir](https://thirdpartyindex.com/vendors/provenir.md) | Credit | United States | 2026-10-02 |
| Pure JAM | Support | United Kingdom | 2026-10-02 |
| [Segment](https://thirdpartyindex.com/vendors/segment.md) | IT | United States | 2026-10-02 |
| [SendGrid](https://thirdpartyindex.com/vendors/sendgrid.md) | Comms | United States | 2026-10-02 |
| [Trulioo](https://thirdpartyindex.com/vendors/trulioo.md) | Compliance | Canada | 2026-10-02 |
| [Vonage](https://thirdpartyindex.com/vendors/vonage.md) | Support | United Kingdom | 2026-10-02 |
| Wise | Payment processing | United Kingdom | 2026-10-02 |
| [Zendesk](https://thirdpartyindex.com/vendors/zendesk.md) | Support | United States | 2026-10-02 |

Read from ([evidence](https://thirdpartyindex.com/evidence/34776)). CSV: https://thirdpartyindex.com/vendors/gocardless/subprocessors.csv

## Subprocessor of (5)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Blackbaud](https://thirdpartyindex.com/vendors/blackbaud.md)
- [FastSpring](https://thirdpartyindex.com/vendors/fastspring.md): Payment Processing
- [Light](https://thirdpartyindex.com/vendors/light.md): Open banking bank feeds. Obtains the end user's consent directly and processes account and transaction data under its own licence.
- [Quaderno](https://thirdpartyindex.com/vendors/quaderno.md): Payments management
- [Speechmatics](https://thirdpartyindex.com/vendors/speechmatics.md): Payment gateway software

## Security contact

From its security.txt (https://gocardless.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/34534)):

- Contact: mailto:vuln-disc@gocardless.com
- Disclosure policy: https://gocardless.com/faq/merchants/security/
- Security jobs: https://gocardless.com/about/jobs/
- No expiry date

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api