To support Aalto in delivering its Services, Aalto engages service providers and Sub-processors to assist Aalto with its data processing activities, including on behalf of Aalto Business Users as defined in our Aalto Services Agreement.
Overview
This page outlines the types of service providers and Sub-processors we utilize, where they are located, and a description of the work they carry out. Capitalized terms used and not defined on this page have the meanings given to them in our Privacy Policy and Data Processing Agreement. Aalto does not currently rely on any affiliated entities to process personal data; if that changes, we will list them here.
What is a Sub-processor?
When Aalto engages third-party service providers in our capacity as a data processor for our Business Users’ personal data, the General Data Protection Regulation (“GDPR”) and a number of other global privacy frameworks call these third-party service providers sub-processors. Sub-processors are service providers who have, or potentially will have, access to or process personal data that Aalto processes for, and on behalf of, Aalto’s Business Users.
Due Diligence
Before engaging any service provider (including Sub-processors), we perform due diligence, including a vendor security assessment proportionate to the data the provider will handle. Our service providers are subject to contract terms designed to ensure that they process personal data only for the purposes of providing services to Aalto and in accordance with our commitments to Business Users and applicable data protection laws.
Summary of Changes
The tables below carry a single page-level revision date, so this section records what changed on each revision and whether an entry is a new appointment (which starts the 30-day objection window described under Updates to this Page) or a correction to how an existing provider is described.
- July 20, 2026. Added Quo (OpenPhone Technologies, Inc.), our business telephony and messaging provider. Quo was already engaged at the time of this update; it is listed to complete this page rather than as a new appointment. Separately, we narrowed the description of Twilio Inc. to reflect that we use Twilio only for one-time sign-in verification codes; Twilio’s role has not expanded.
List of Sub-processors
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| DigitalOcean, LLC | Business User and Representative data, End User data, and End Customer data | Cloud service provider | United States |
| Amazon Web Services, Inc. | Business User and Representative data, End User data, and End Customer data | Cloud service provider | United States |
| Vercel Inc. | Business User and Representative data, End User data, and Visitor data | Cloud service provider | United States |
| Stripe, Inc. | Business User and Representative data, End User data, and End Customer data | Payment services provider | United States |
| Twilio Inc. | End User data and Business User data | Cloud communications platform as a service, used for one-time sign-in verification codes | United States |
| Quo (OpenPhone Technologies, Inc.) | Business User and Representative data, End User data, End Customer data, and Visitor data | Business telephony and messaging provider: the support phone line on which we place and receive calls (including any recording and automated transcript of those calls) and driver text notifications | United States |
| Resend, Inc. | End User data and Business User data | Email delivery service provider (delivers over Amazon SES) | United States |
| Google LLC | End User data and Visitor data | Maps and geocoding service provider | United States |
| Smartcar, Inc. | Business User data and End Customer data | Vehicle connectivity service provider | United States |
| Grafana Labs | Business User data, End User data, and End Customer data contained in service logs | Cloud logging and monitoring provider | United States |
| ipinfo.io (DNSimple Corporation) | IP addresses | IP geolocation service provider | United States |
List of Service Providers
The below service providers support Aalto’s own operations (such as analytics, internal communications, and internal support tooling) rather than processing personal data on behalf of Business Users.
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| Mixpanel, Inc. | End User data and Visitor data | Product analytics provider | United States |
| Slack Technologies, LLC | Information included in internal alerts and support workflows | Internal communications platform | United States |
| Google LLC | Information included in communications with Aalto | Email, file storage, and collaboration tools | United States |
Updates to this Page
Due to the nature of our business, our business needs and service providers may change from time to time. For example, we may deprecate a service provider to consolidate and minimize our use of service providers, or add a service provider if we believe that doing so will enhance our ability to deliver our Services.
We will periodically update this page to reflect additions and removals to our list of service providers and Sub-processors. Under the terms of our Data Processing Agreement (DPA), a Business User may reasonably object in writing to the processing of its personal data by a new Sub-processor within 30 days following the update of this page. If a Business User does not object during the 30-day time period, the appointment of the new Sub-processor will be deemed accepted by the Business User.
For more information on Aalto’s privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us at privacy@aalto.energy.