About Us Contact Support Sign Up Log In
Request a Demo
Legal documents

Sub-processor List

Version 1.1 · 10/25/2026

Last updated: 25 October 2026 (version 1.1).

1. Purpose

This document identifies the third-party sub-processors engaged by GlobeID Limited
(“GlobeID”) to process Personal Data on behalf of Customers in connection with the
PassportScan Cloud services, in accordance with Article 28(2) and 28(4) of the GDPR.

This Sub-Processor List forms an integral part of the Data Processing Agreement (DPA).

2. General Principles

  • Sub-processors are engaged only where strictly necessary to provide the Services
  • All sub-processors are bound by written data protection agreements imposing obligations no less protective than those set out in the DPA
  • GlobeID remains fully liable for the acts and omissions of its sub-processors in accordance with Article 28(4) GDPR
  • Core platform databases are hosted exclusively within the European Union (AWS eu-west-1 – Ireland)
  • Where regional S3 storage is enabled, document images are stored in the AWS region corresponding to the hotel’s operational jurisdiction
  • No cross-region replication of core databases is configured
  • PassportScan Cloud does not maintain a Cardholder Data Environment (CDE)

3. Authorized Sub-Processors (Unified Table)

Sub-Processor Service Category Purpose / Function Data Categories Processed Processing Location
Amazon Web Services, Inc. (AWS) Cloud Infrastructure & Hosting Hosting of application services, databases, encrypted object storage (S3), backups, infrastructure security Identity data, reservation data, logs, document images (where enabled) Core: EU (Ireland – eu-west-1). S3: region aligned with the hotel's jurisdiction — currently EU (Ireland), United States (us-east-1), Brazil (sa-east-1), Singapore (ap-southeast-1) and Australia (ap-southeast-2)
Clerk, Inc. Identity & Authentication User authentication, identity verification, session lifecycle management Email address, IP address, device metadata, session tokens As disclosed in Clerk documentation
Datadog, Inc. Logging & Monitoring Infrastructure monitoring, application performance monitoring, security logging, anomaly detection Application and infrastructure logs: request metadata and, where captured, request and response content; IP addresses; authentication events; technical diagnostics. Personal data and secrets are masked in the services before logs are sent to Datadog EU (Datadog EU site – datadoghq.eu)
Google LLC (reCAPTCHA Enterprise) Bot Protection & Abuse Prevention Bot and abuse protection for the guest-facing self-check-in application Guest IP addresses, device and browser signals As disclosed by Google
Google LLC (Google Workspace) Business Communications E-mail and documents used for customer support correspondence; any Customer Personal Data is incidental to that correspondence Contact details and content of support correspondence (incidental) As disclosed by Google
Stripe, Inc. Payment Processing Credit purchase transactions and account activation Processed by Stripe: payment card data, billing details, transaction identifiers. Received by PassportScan Cloud: transaction ID, payment status, amount, currency, billing email (if provided) As disclosed in Stripe documentation

4. Explicit Exclusions

  • Identity-document OCR is performed by an engine operated entirely within GlobeID’s own AWS environment: document images are never sent to an external OCR provider
  • Internal tooling operated by GlobeID (operations platform, CI/CD, VPN) is not a third-party sub-processor; the underlying hosting is covered by the AWS entry above
  • Software engineering tools used internally, including AI-assisted development tools, are not given access to Customer Personal Data and are therefore not sub-processors
  • Development and test environments do not contain Customer Personal Data
  • No sub-processor other than AWS, which as hosting provider manages server-side encryption at rest, has access to identity document data
  • PassportScan Cloud does not store or process raw payment card numbers, CVV codes, or expiration dates
  • Stripe processes cardholder data within its PCI-DSS compliant infrastructure
  • No cross-region replication of primary production databases is enabled

5. International Data Transfers

Where sub-processors process data outside the European Economic Area (EEA),
GlobeID ensures that appropriate safeguards are implemented, including Standard
Contractual Clauses (SCCs) or other lawful transfer mechanisms in accordance with GDPR Chapter V.

For regional S3 storage outside the EEA, transfers are based on the AWS Data Processing Addendum and applicable SCCs.

6. Updates and Notifications

GlobeID may update this Sub-Processor List from time to time.

In accordance with GDPR Article 28(2) and the notification mechanism and notice period set out in the DPA, GlobeID will inform Customers in advance of any intended addition or replacement of sub-processors, giving Customers the opportunity to object, and will publish an updated
Sub-Processor List.

Where required by applicable law or the DPA, Customers may object in accordance with
the contractual procedure set out in the DPA.

The most recent version of this document will always be published with the updated date.

Passportscan