Legal
Subprocessors
Last updated July 24, 2026
iterateTo engages the third-party vendors below to provide the service. Each is bound by data-protection terms no less protective than those in our DPA.
Template. This document is a starting point, not legal advice. Review it with legal counsel and tailor it to your business before relying on it in production.
Current subprocessors
This list is versioned; the effective date is July 24, 2026. We update it when a subprocessor is added or removed.
| Subprocessor | Purpose | Location |
|---|---|---|
| MongoDB Atlas | Primary database and screenshot storage (feedback records). | United States (configurable region) |
| Resend | Transactional email (verification, invitations, notifications). | United States |
| Hosting / CDN — TBD at deploy | Application hosting, static asset and widget delivery. | To be determined at deployment |
Changes and notifications
We provide advance notice of intended changes to this list so customers have the opportunity to object, as described in our Data Processing Addendum. The hosting/CDN provider is marked as to-be-determined and will be finalized before the service leaves beta.
Contact
Questions about our subprocessors can be sent to privacy@iterateto.example.