Upcoming version 1.1.0. It takes effect on 2026-12-01.
Until then, the version in force applies.
Links to other documents lead to the versions in force on 2026-12-01.
This page lists the subprocessors of MIDDAG, LLC (“MIDDAG”), the third parties that MIDDAG engages to process personal data on behalf of its Business customers, and the other service providers that process personal data on behalf of MIDDAG as controller.
1. How this page works
1.1. This page forms part of the Data Processing Addendum (“DPA”) and of the Terms of Service.
1.2. For Business customers, as defined in the Terms of Service, the subprocessors in section 2 process Customer Personal Data on behalf of MIDDAG, under the DPA.
1.3. The other service providers in section 2a process personal data on behalf of MIDDAG as controller, such as data of accounts, billing, business contacts and the work of the team, as described in the Privacy Policy; they are not subprocessors under the DPA.
1.4. For Consumers, as defined in the Terms of Service, and for anyone whose personal data MIDDAG processes as controller, the providers of sections 2 and 2a act on behalf of MIDDAG as described in the Privacy Policy.
1.5. MIDDAG reviews each subprocessor and each other service provider before engaging it and periodically after that, and binds it by a written agreement with data protection obligations, as the DPA describes.
2. List of subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting of the platforms operated for clients | United States (us-east-1) |
| Atlassian | Work tracking and on-call alerting | Not yet determined |
| Cloudflare | Name resolution, content delivery and access protection | Not yet determined |
| Sentry | Error tracking of the platforms operated for clients | Not yet determined |
2.1. “Global” means that the provider may process data in any of the countries where it operates, regardless of where the Customer is located, to deliver its service.
2.2. “Not yet determined” means that MIDDAG has not yet confirmed the processing location of that provider.
2.3. MIDDAG will update this page when it confirms the processing location of a provider, as an update of information that does not change the list of subprocessors.
2a. Other service providers
| Service provider | Purpose | Location |
|---|---|---|
| Anthropic | AI model used by the team’s agent tools | Not yet determined |
| Google Cloud | Search index over the organization’s documents | Global |
| Google Workspace | E-mail, documents and sign-in of the team | Not yet determined |
| HubSpot | Customer relationship management, marketing e-mail and support | Not yet determined |
| Stripe | Payments and invoicing | Not yet determined |
2a.1. The meanings of “Global” and “Not yet determined” in section 2 apply to this table.
2a.2. A change to this table is an update of the information in the Privacy Policy, published on this page, and does not give a right to object under the DPA.
3. Changes to this list
3.1. MIDDAG gives notice of a new or replaced subprocessor of section 2 30 days before the effective date of the change.
3.2. The notice is sent by e-mail through the MIDDAG Account to the account holders of the customers, and the change is published on the Updates page, as an upcoming version of this page, until its effective date.
3.3. A Business customer may object to a new or replaced subprocessor on reasonable grounds related to the protection of personal data, under clause 8 of the DPA, by written notice to [email protected] or through the form of the MIDDAG Account, received before the effective date of the change.
3.4. An objection received after the effective date of the change has no effect, and the absence of a timely objection is acceptance of the change.
3.5. On a timely objection, MIDDAG offers a good-faith alternative where reasonably possible.
3.6. If the parties do not reach a solution, the Business customer’s sole remedy is to cancel the affected service at the end of the period already paid, without refund.
3.7. MIDDAG is not obliged to stop using a subprocessor because of an objection.
3.8. For Consumers, MIDDAG acts as controller, and a change to this list is an update of the information in the Privacy Policy.
3.9. When a change is required by law or by an authority, or is needed for the security of the services, MIDDAG may make it with notice given at once, under clauses 8.12 and 8.13 of the DPA, which also say when the Standard Contractual Clauses require prior notice and how a Business customer may object afterwards.
4. Contact
4.1. Questions about this page: [email protected].
Changelog
- 1.1.0 — 2026-11-01 — Changes after the legal review of the first version: the subprocessors that process Customer Personal Data (section 2) are separated from the other service providers of MIDDAG as controller (section 2a), which now also lists Google Workspace and HubSpot; the right to object applies to section 2; urgent changes follow clauses 8.12 and 8.13 of the DPA.
- 1.0.0 — 2026-11-01 — First version of the list of subprocessors of MIDDAG, LLC.