Subprocessors

ScholarshipOwl Subprocessors

Vendor	Data Processed	Location	Purpose
Google Cloud	Application data, logs	USA / EU (Germany)	Data processing + analytics
Intercom	User ID, email, message history	USA/EU	Customer support messaging
Stripe	Billing info, name, email	USA	Payment processing
Fathom Analytics	Contact records, user IDs, behavioral data, form submissions	USA / EU (Germany)	Marketing automation, CRM, sales enablement
HubSpot	Website usage metrics, aggregated visitor data (non-PII by design)	USA / EU (Germany)	Website analytics (privacy-focused)

How We Evaluate and Approve Subprocessors

Before engaging a subprocessor, we perform a risk assessment that includes:

Security and privacy review
Analysis of compliance with relevant regulations (GDPR, CCPA, FERPA if relevant)
Review of contractual protections (DPA, SCCs where needed)
Data minimization evaluation
Ongoing monitoring and periodic reviews

Only subprocessors who meet our required standards are approved.

How We Notify Customers of Changes

We will notify customers of any intended changes to our subprocessor list by posting changes on this page. Customers may object to changes as specified in the Terms of Use.