Subprocessors
Last updated: 2026-10-31
This page lists the third-party providers that Traxelio is configured to use, and the categories of data that each integration sends them.
- This list covers the Traxelio website and servers. It does not cover the Traxelio mobile app.
- A listed provider is one that Traxelio is configured to use. Rows say when a provider is not used in production (see note 1).
- This list does not describe contracts, data processing agreements or location guarantees, except where stated.
A. Infrastructure and hosting
| Provider | Role | Data shared (per the integration) | Stated location |
|---|---|---|---|
| Amazon Web Services | Role Hosts Traxelio: application servers, databases, queues, object storage, backups and infrastructure logs. | Data shared (per the integration) All platform data: accounts, vehicles, positions, histories, documents and logs. | Stated location eu-north-1 (Stockholm, EU) for servers, databases, queues, storage and backups; email sending in eu-west-3 (Paris, EU) |
| Cloudflare | Role Content delivery network and proxy in front of the AWS load balancer; R2 object storage (public content, dashcam segments and thumbnails); AI Gateway, which relays requests to the AI providers listed in table B. | Data shared (per the integration) Web requests (IP address, headers); files stored in R2; the content of relayed AI requests (see table B), which the AI Gateway keeps in its request logs. | Stated location R2: Eastern North America (public content, dashcam segments and thumbnails) and Western North America (internal media sources). CDN and AI Gateway: Cloudflare global network |
| DigitalOcean | Role Self-hosted Mailcow mail server (Traxelio mailboxes and outgoing email for some flows). | Data shared (per the integration) Content and metadata of emails exchanged with Traxelio mailboxes. | Stated location London, United Kingdom (DigitalOcean lon1) |
B. Services that handle customer data
Payments
| Provider | Data shared (per the integration) |
|---|---|
| Stripe | Data shared (per the integration) Amount, currency, order lines, payment reference, return addresses. Card details are entered on the provider's payment page. |
| PayPal | Data shared (per the integration) Amount, currency, payment identifier, return addresses. |
| Wave | Data shared (per the integration) Amount, currency, payment reference, return addresses. |
| Orange Money | Data shared (per the integration) Amount, currency, payment reference, return addresses. |
| Pay.sh | Data shared (per the integration) Amount, currency, payment reference, description, return addresses. Payments are verified through the PayAI facilitator on the Solana network. |
Messaging and notifications
| Provider | Data shared (per the integration) | Stated location |
|---|---|---|
| Amazon SES | Data shared (per the integration) Recipient address and content of transactional and marketing emails. Sending through SES is on in production. | Stated location eu-west-3 (Paris, EU) |
| Postmark | Data shared (per the integration) Supported in the code, but no Postmark key is set in production: not used. | Stated location Not used in production |
| Mailcow (DigitalOcean) | Data shared (per the integration) Recipient address and content of emails sent from Traxelio mailboxes, and of emails sent by the servers through this mail server. | Stated location London, United Kingdom (see table A) |
| Twilio | Data shared (per the integration) Recipient number and SMS text; voice calls to the SIM cards in trackers. | Stated location No region set in our configuration (provider default) |
| HTTP SMS | Data shared (per the integration) Recipient number and SMS text. | Stated location No region set in our configuration (provider default) |
| Meta (WhatsApp Business) | Data shared (per the integration) Recipient number and template message. Off in production. | Stated location No region set in our configuration (provider default) |
| Expo | Data shared (per the integration) Device notification token, title and text of push notifications. | Stated location No region set in our configuration (provider default) |
| Slack | Data shared (per the integration) Internal alert and operations messages, which may mention user names, email addresses or identifiers. | Stated location No region set in our configuration (provider default) |
Tracker connectivity
| Provider | Data shared (per the integration) |
|---|---|
| Things Mobile | Data shared (per the integration) Line number (MSISDN) and SIM card identifier (ICCID), to check status and activate SIM cards. |
| Hologram | Data shared (per the integration) SIM card and device identifiers (Hologram returns the IMEI), to find the cellular link and read data usage. |
Maps and geolocation
| Provider | Data shared (per the integration) |
|---|---|
| Google Maps Platform (Places, Geocoding) | Data shared (per the integration) Address text typed, language, country and an approximate position resolved from the request, for address suggestions; place identifier for place details; address to geocode. |
| Mapbox | Data shared (per the integration) Map display requests sent by the browser (displayed area, browser IP address). |
Artificial intelligence
| Provider | Data shared (per the integration) |
|---|---|
| Anthropic | Data shared (per the integration) For the chat assistant's high-intent replies, and as a fallback for internal search indexing: system instruction, conversation messages and results of the tools it calls (see note 2). |
| Google (Gemini) | Data shared (per the integration) Default provider in production for the chat assistant, its tools and internal search indexing; same content as above (see note 2). |
Monitoring, security and identity
| Provider | Data shared (per the integration) |
|---|---|
| Sentry | Data shared (per the integration) Error and performance reports: technical trace, request address, runtime context. Automatic collection of personal data is turned off in the configuration; public tracking link tokens are masked. Reports go to Sentry's ingest endpoint ingest.sentry.io, not its EU endpoint. |
| Google reCAPTCHA | Data shared (per the integration) Anti-abuse verification token produced in the browser at checkout and on forms. |
| Google, Apple, Microsoft (sign-in) | Data shared (per the integration) Identity token issued by the provider the user picks at sign-in. Google and Apple are set up in production; Microsoft sign-in is supported in the code but not set up in production. |
Vehicle identifiers sent to external services
| Provider | Data shared (per the integration) |
|---|---|
| NHTSA (vPIC) | Data shared (per the integration) Vehicle identification number (VIN) for decoding. On in production. |
| VehiCode | Data shared (per the integration) VIN for decoding. On in production. |
| VinWhere, VinFoundry, VinSpecs | Data shared (per the integration) VIN for decoding. All three are on in production. |
C. Marketing and audience measurement only
These providers do not take part in delivering the tracking service.
| Provider | Data shared (per the integration) |
|---|---|
| Google Ads and Google tag | Data shared (per the integration) Ad click identifier; email and phone as a SHA-256 hash for conversions; audience measurement in the browser. |
| Meta (Pixel and Conversions API) | Data shared (per the integration) Browser IP address and user agent, Meta cookie identifiers; SHA-256 hash of email, phone, city, country and an external identifier. |
Notes
- Activation. Production keys are not published. Each row was checked against our production configuration on the date above; a row says so when a provider is supported in the code but not used in production.
- Chat assistant. The content sent to AI providers is what the assistant builds for each exchange. The detail per flow is not repeated here.