Legal
TestCollab subprocessor list
Annex to the TestCollab Data Processing Agreement (clause 4.1). It lists every third party that processes Customer Data on our behalf.
Scope
This annex lists third parties that process Customer Data: the content customers store in TestCollab and the personal data of their users, processed on TestCollab's behalf.
It is deliberately narrower than the third party list in our website privacy policy. That policy covers analytics and advertising services that act on visitors to testcollab.com and never touch a customer's TestCollab account. Those are not subprocessors and are not listed here.
Changes to this list are notified at least 30 days in advance under DPA clause 4.2.
1. Subprocessors of Customer Data
Essential subprocessors are required to deliver the service and cannot be declined. Optional subprocessors are tied to a feature a customer can decline, in which case they are not engaged for that customer at all.
| Subprocessor | Essential / Optional | Purpose | Data categories | Processing region |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Essential | Application hosting, database, file and attachment storage, backups, transactional email (Amazon SES), content delivery | All Customer Data: test cases, plans, runs, results, attachments, comments, user account records | EU: eu-central-1 (Frankfurt). US: us-east-1. Per the customer's chosen region. |
| Intercom, Inc. | Optional: in-app support, can be disabled for a tenant | In-app support and messaging | User name, email address, company name, and the content of support conversations | United States |
| Stripe, Inc. | Optional: not engaged for customers billed by invoice | Card payment processing, subscription and invoice billing | Billing contact email, phone, and billing address (line 1, city, state, country); payment method token; subscription and invoice records (plan, seat count, amounts). Card details are entered directly into Stripe's hosted fields in the browser and never reach TestCollab's systems. | Global, including the United States. Stripe does not offer EU only data residency. See note below. |
Stripe processes payment data globally by design and offers no EU only residency option. EEA customers contract with Stripe Payments Europe, Ltd., and transfers to Stripe, LLC in the United States rely on Stripe's certification under the EU-US Data Privacy Framework together with Standard Contractual Clauses. Stripe is not engaged at all for customers billed by invoice rather than card, which is the usual arrangement for enterprise agreements. The data involved is billing contact and subscription information only. No test data or end user records reach Stripe.
The Intercom workspace is hosted in the United States, and an Intercom workspace's region is fixed at creation and cannot be migrated. For customers in the EEA this is a transfer of personal data outside the EEA, covered by the Standard Contractual Clauses under DPA clause 6.2. Customers who prefer no transfer at all can have in-app support disabled for their tenant, in which case Intercom is not engaged and no data reaches it.
2. Conditional subprocessors
Everything in this section is Optional by definition: engaged only when the customer has enabled the relevant feature, and not engaged at all where it is disabled.
All TestCollab AI features are opt-in and can be disabled organisation wide. Where they are disabled, no data of any kind is sent to the providers below and they are not engaged as subprocessors for that customer.
| Subprocessor | Purpose | Data categories | Processing region |
|---|---|---|---|
| OpenAI, L.L.C. | AI assisted test case generation and QA Copilot | Test case content submitted to the feature: titles, descriptions, steps and expected results, plus the user's prompt | United States |
| Anthropic, PBC | AI assisted test case generation and QA Copilot | As above | United States |
Both providers are used through their API tiers, under which customer content is not used to train their models. Prompts are retained by the provider for up to three months for abuse monitoring, then deleted.
TestCollab is testing model inference through Amazon Bedrock. If adopted, inference runs inside TestCollab's own AWS account, including in eu-central-1 for EU customers. Bedrock would therefore add no new subprocessor: AWS is already listed in section 1, and no customer content would leave it.
3. Not subprocessors: customer instructed integrations
Where a customer connects TestCollab to their own tooling, the transfer is instructed by the customer to a system the customer already controls. TestCollab does not act as a processor engaging a subprocessor in these cases.
- Microsoft Azure DevOps
- Atlassian Jira
- GitHub
- GitLab
4. Relationship to the SOC 2 report
TestCollab's SOC 2 Type II report identifies Amazon Web Services and GitLab, Inc. as subservice organisations.
That is a different test: a subservice organisation is a party carved out of the audit scope, whereas a subprocessor is any party processing personal data on our behalf. GitLab hosts TestCollab's own source code and does not process Customer Data, which is why it appears in the SOC 2 report but not in section 1 above.
Version history
| Version | Date | Change |
|---|---|---|
| 3.1 | August 2026 | Sentry removed. Error events no longer carry user or company identifiers, so Sentry no longer processes personal data. |
| 3.0 | August 2026 | Reissued in this form as an annex to the Data Processing Agreement, separating processors of Customer Data from the website third parties listed in the privacy policy. |
| 2.0 | January 2026 | Anthropic added, on the launch of AI test case generation. |
| 1.1 | June 2024 | OpenAI added, on the launch of QA Copilot AI features. |
| 1.0 | September 2023 | Initial subprocessor list, compiled six months ahead of the SOC 2 audit period that began 5 March 2024. |
