# Subprocessors

A subprocessor is a company that processes personal data for us when we process it for a business that uses to.co: messages to the business, data used through the API, MCP servers and webhooks, published content and, when available, trading documents. This is the list our data processing agreement refers to.

We give at least 30 days’ notice before we add or replace a subprocessor, and we email the Owners of every business on to.co. A business may object on data protection grounds before the change takes effect, through our [contact page](https://my.to.co/contact?purpose=privacy).

## Current subprocessors

### [Cloudflare, Inc.](https://www.cloudflare.com/)

- What it does: Hosting and serving the service, storage, queues and background jobs; the AI models that check and summarise messages; the check that a sender is a person.
- Personal data: All personal data we process for businesses, in transit and at rest.
- Where: Cloudflare's global network. A United States company.
- Protection when data leaves the UK or the EEA: Cloudflare's data processing addendum (version 6.4, 3 April 2026): the EU–US Data Privacy Framework and its UK Extension where Cloudflare's certification covers the transfer; otherwise the EU Standard Contractual Clauses with the UK Addendum.
- On the list since: Before this list was published

### [PlanetScale, Inc.](https://planetscale.com/)

- What it does: The database.
- Personal data: All personal data we process for businesses, except files.
- Where: Our production database's primary and both replicas are hosted in AWS's London region (eu-west-2), United Kingdom. PlanetScale may access or process personal data from other countries when providing support and operating the service. A United States company.
- Protection when data leaves the UK or the EEA: PlanetScale is listed on the Data Privacy Framework register as an active participant under the EU–US Data Privacy Framework and its UK Extension (checked 9 November 2026). Its data processing addendum (15 October 2026) also includes the EU Standard Contractual Clauses.
- On the list since: Before this list was published

### [Resend (Plus Five Five, Inc.)](https://resend.com/)

- What it does: Sending email: message notifications, invitations and notices.
- Personal data: Email addresses and email content.
- Where: United States.
- Protection when data leaves the UK or the EEA: International transfers are covered by the EU Standard Contractual Clauses with the UK Addendum, as incorporated into Resend's data processing addendum dated 31 December 2025. Resend is also listed on the Data Privacy Framework register as an active participant under the EU–US Data Privacy Framework and its UK Extension (checked 9 November 2026).
- On the list since: Before this list was published

## Changes coming up

No changes are planned.

## Past changes

No changes have been made since this list was published.

Last updated 9 Nov 2026, 10:29 pm (UTC). The same list as data: [JSON](https://api.to.co/v1/public/subprocessors). This page as Markdown: [Markdown](https://to.co/en-nz/subprocessors?format=md).