Third-party vendors that help us deliver the MSH service.
Last updated: 25 March 2026
When we add, remove, or change a sub-processor, we:
1. Update this page
2. Notify customers with active annual or enterprise subscriptions by email at least 30 days before the change takes effect, giving you time to object or terminate if you disagree.
3. Notify customers on monthly plans by email within 7 days of the change.
To subscribe to sub-processor change notifications independently of your account, email privacy@marketingsohigh.com with "Subscribe sub-processor updates" in the subject.
Every sub-processor on this list is contractually required to:
- Process data only on MSH's documented instructions
- Maintain confidentiality and appropriate security measures (per GDPR Art. 32 / DPDP §8)
- Notify MSH of data breaches without undue delay
- Assist with data subject rights requests
- Delete or return data at the end of the service
- For cross-border transfers from the EU/UK: use Standard Contractual Clauses (2021 version) or another adequate transfer mechanism
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, serverless compute | All application requests, IP addresses, request logs | USA | SCCs (2021); SOC 2 Type II |
| Supabase Inc. | Database, authentication, storage, realtime | Account data, customer content, integration data, uploaded files | USA (primary), EU (optional regional) | SCCs (2021); SOC 2 Type II; GDPR-compliant DPA |
| Hostinger International Ltd | Legacy WordPress marketing site hosting, VPS for n8n workflows | Marketing site visitors (anonymized GA); VPS hosts n8n only | EU (Lithuania) | GDPR-compliant DPA; EU-based so no transfer needed |
| Cloudflare Inc. | CDN, DDoS protection, bot mitigation | IP addresses, request metadata | Global (EU-routed when possible) | SCCs (2021); SOC 2 Type II |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC | "Sign in with Google" authentication; OAuth tokens for integrations (when you connect Google Search Console / Analytics — Phase 2, not yet active) | Email, name, profile picture; on integration connect: OAuth refresh/access tokens | USA, Global | SCCs (2021); EU-US Data Privacy Framework-certified |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Stripe Payments Europe Ltd / Stripe Inc. | Payment processing | Name, email, billing address, card details (card details NEVER touch MSH servers) | Ireland (EU customers), USA | SCCs (2021); PCI-DSS Level 1; EU-US DPF |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Resend Inc. | Transactional email (signup, password reset, notifications); outbound campaigns if you use MSH's email features | Recipient email, email content, delivery metadata, open/click events (if enabled) | USA | SCCs (2021); GDPR-compliant DPA |
| SendGrid / Twilio Inc. | Backup/high-volume transactional email (optional) | Same as Resend | USA | SCCs (2021); SOC 2 Type II |
When you use MSH's AI features (content generation, refresh, chat assistant), prompts and context are sent to AI providers to generate a response. We route to different providers based on the feature and your plan's BYOK (Bring Your Own Key) settings.
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Gemini API) | AI content generation (default) | Prompts (which may include content you're refreshing) and generated responses | USA, Global | SCCs (2021); Google promises data is NOT used to train models when accessed via paid API |
| OpenAI, L.L.C. | GPT model access | Prompts + responses | USA | SCCs (2021); API data NOT used for training per OpenAI API terms |
| Anthropic, PBC | Claude model access | Prompts + responses | USA | SCCs (2021); API data NOT used for training per Anthropic commercial terms |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| DataForSEO (DFS) | Keyword research, SERP data, competitor analysis | Keywords you search; customer data NOT sent | Estonia (EU) | EU-based; no transfer needed |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Chatwoot | Support chat | Email, name, conversation content | Self-hosted on our VPS (EU Lithuania) | No third-party sharing — we host it |
| Sub-processor | Service | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google Analytics (GA4) | Marketing site analytics (not the product dashboard) | Aggregated visits, referrer, device type; IP anonymization ON; Google Signals OFF | USA, Global | SCCs (2021); EU-US DPF; IP anonymization enabled |
These will be activated when MSH Intelligence launches (not yet in production):
| Sub-processor | Service | Purpose | Status |
|---|---|---|---|
| Google LLC (Search Console API) | Retrieving your GSC data for personal reports and (opt-in) MSH Intelligence aggregation | Phase 2 | Not yet active |
| Google LLC (Analytics Data API) | Retrieving your GA4 data for reports | Phase 2 | Not yet active |
When these activate, we'll update this page and notify customers 30 days in advance.
| Date | Change | Reason |
|---|---|---|
| 2026-04-16 | Initial publication | First public version |
Email privacy@marketingsohigh.com.
If you're a B2B customer conducting a vendor security review and need:
- Copies of signed DPAs with any sub-processor
- Sub-processor security questionnaire responses
- Specific SCC attestations
Email privacy@marketingsohigh.com and we'll provide what we're able to share without breaching the sub-processor's own confidentiality obligations.