MCP Express

Sub Processors List

Last Updated date: October 19, 2025

MCP Express uses the following third-party service providers (“sub-processors”) to provide our services. All sub-processors are selected based on their security practices, compliance certifications, and data protection standards.

Payment Processing

Stripe Inc.

  • Location: USA/EU
  • Purpose: Process subscription payments, manage billing, and handle payment method storage
  • Data Processed: Payment information, billing details, transaction records
  • Data Transfers: Standard Contractual Clauses (EU-US); PCI DSS Level 1 certified
Infrastructure and Hosting

Amazon Web Services (AWS)

  • Location: EU Region (Frankfurt/Ireland)
  • Purpose: Host platform infrastructure, store customer data, execute MCP server requests, deliver services
  • Data Processed: Application data, customer configurations, MCP server definitions, usage metrics, logs
  • Data Transfers: EU data residency maintained; AWS GDPR Data Processing Addendum
Analytics and Monitoring

Google Analytics

  • Provider: Google LLC
  • Location: USA
  • Purpose: Website and platform analytics, understand usage patterns, improve user experience
  • Data Processed: Anonymized usage data, page views, feature adoption metrics
  • Data Transfers: Standard Contractual Clauses and EU-US Data Privacy Framework

Microsoft Clarity

  • Provider: Microsoft Corporation
  • Location: USA
  • Purpose: User behavior analytics, session recordings, and heatmaps to improve user experience
  • Data Processed: Anonymized user interactions, session data (with PII masking)
  • Data Transfers: Standard Contractual Clauses and EU-US Data Privacy Framework
Communication Services

Microsoft 365

  • Provider: Microsoft Corporation
  • Location: USA/EU
  • Purpose: Business email, send service notifications, support responses, customer communications
  • Data Processed: Email content, customer correspondence, support communications
  • Data Transfers: EU data centers available; Standard Contractual Clauses for US transfers; Microsoft EU Data Boundary
Customer Support and Operations

Atlassian Jira

  • Provider: Atlassian Pty Ltd
  • Location: USA/Australia
  • Purpose: Support ticket management, issue tracking, customer support workflow
  • Data Processed: Support requests, customer issues, communication history, account information
  • Data Transfers: Standard Contractual Clauses; EU data residency option available
Observability and Logging

AWS CloudWatch

  • Provider: Amazon Web Services
  • Location: EU Region
  • Purpose: Application monitoring, debug logging, performance metrics, error tracking
  • Data Processed: System logs, performance data, error reports, request traces
  • Data Transfers: EU data residency maintained; AWS GDPR Data Processing Addendum
Authentication and Identity

AWS Cognito

  • Provider: Amazon Web Services
  • Location: EU Region (Frankfurt/Ireland)
  • Purpose: User authentication, Single Sign-On (SSO), identity management, multi-factor authentication
  • Data Processed: Authentication credentials, user identity information, login activity, session data
  • Data Transfers: EU data residency maintained; AWS GDPR Data Processing Addendum
Data Transfer Mechanisms

For sub-processors located outside the European Economic Area (EEA), we ensure adequate data protection through:

  1. Standard Contractual Clauses (SCCs): EU-approved contractual terms for international data transfers
  2. EU-US Data Privacy Framework: For US-based processors certified under the framework
  3. Data Residency Options: Preference for EU-based infrastructure where available
  4. Supplementary Measures: Additional technical and organizational safeguards as required by GDPR
Sub-Processor Changes

MCP Express reserves the right to update this list of sub-processors. We will:

  • Notify customers at least 30 days in advance of adding new sub-processors
  • Provide notification via email to account administrators
  • Update this page with the effective date of changes
  • Allow Enterprise customers to object to new sub-processors within the notification period

For Enterprise customers with specific data processing requirements, alternative sub-processors or additional safeguards may be negotiated.

Regional Data Storage
  • Primary Infrastructure: AWS EU-Central-1 (Frankfurt)
  • Customer Data: Stored exclusively in EU regions
  • Backup Data: Replicated within EU regions only
  • Processing: Lambda functions execute in EU regions
Questions or Concerns

If you have questions about our sub-processors or data processing practices, please contact:

Cart (0 items)

Create your account