This Sub-processor Schedule (this “Schedule”) is published by Crunchafi LLC and its Affiliate Crunchafi Data Extraction, Inc. (“Crunchafi”) and lists the third parties that Crunchafi has engaged to Process Customer Personal Data on behalf of its customers in connection with the provision of the Crunchafi services (the “Services”). This Schedule is incorporated by reference into the Crunchafi Data Processing Addendum (the “DPA”) and supplements Annex III of the DPA. Capitalized terms not defined in this Schedule have the meanings given to them in the DPA or the Crunchafi Subscription Agreement.
Crunchafi maintains this Schedule at https://www.crunchafi.com/legal/sub-processors. The version published at that URL from time to time is the authoritative list and supersedes any earlier version. In the event of any conflict between this Schedule and Annex III of the DPA, this Schedule shall prevail.
Authorized Sub-processors
Crunchafi Affiliates
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Crunchafi LLC |
Lease Accounting |
Provision, support, and security operations of the Lease Accounting Services. Product engineering, product operations, and customer support. |
United States |
Direct engagement; intra-group data protection terms. |
| Crunchafi Data Extraction, Inc. |
Data Extraction |
Provision, support, and security operations of the Data Extraction Services. Product engineering, product operations, and customer support. |
United States |
Direct engagement; intra-group data protection terms; SCCs / UK IDTA where applicable. |
Cloud Infrastructure and Hosting
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Microsoft Azure |
Lease Accounting, Data Extraction |
Platform-as-a-Service provider used for cloud hosting of the Services, including compute, storage, managed databases, object storage, and backup. All Customer Personal Data Processed through the Services is stored on this infrastructure. |
Lease Accounting: United States, United Kingdom
Data Extraction: United States, Netherlands, Australia |
Direct engagement; provider’s EU SCCs and UK IDTA where applicable. |
| Microsoft 365 |
Lease Accounting, Data Extraction |
Productivity and collaboration suite used internally by Crunchafi personnel for email, calendaring, document storage, and collaboration (Exchange Online, SharePoint, OneDrive, Teams). Customer Personal Data may be Processed incidentally where it appears in business communications, support correspondence, or attachments handled by Crunchafi personnel. |
United States |
Provider’s EU SCCs and UK IDTA. |
Transactional Email and Communications
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Postmark |
Lease Accounting |
Delivery of transactional and notification emails (account verification, password reset, alerts, scheduled reports) to End Users on Customer’s behalf. |
United States |
Provider’s EU SCCs and UK IDTA. |
| SendGrid |
Data Extraction |
Delivery of transactional and notification emails (account verification, password reset, alerts, scheduled reports) to End Users on Customer’s behalf. |
United States |
Provider’s EU SCCs and UK IDTA. |
Customer Support and CRM
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| HubSpot |
Lease Accounting, Data Extraction |
Receipt, triage, routing, and resolution of support tickets and live-chat conversations. HubSpot is Crunchafi’s CRM provider. |
United States |
Provider’s EU SCCs and UK IDTA. |
Product Analytics and Telemetry
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Pendo |
Lease Accounting, Data Extraction |
Aggregate usage analytics: page views, feature interactions, session metadata. |
United States |
Provider’s EU SCCs and UK IDTA. |
| Power BI (Microsoft) |
Lease Accounting, Data Extraction |
Business-intelligence and reporting platform used by Crunchafi personnel to build internal dashboards and analyze operational, usage, and billing data. Source data is limited to aggregated and pseudonymized records exported from Crunchafi systems; access is restricted to authorized personnel under role-based controls. |
United States |
Provider’s EU SCCs and UK IDTA. |
Authentication and Identity
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Auth0 (Okta, Inc.) |
Data Extraction |
End User authentication and single sign-on for the Services. |
United States |
Provider’s EU SCCs and UK IDTA. |
| Microsoft Entra ID (formerly Azure Active Directory) |
Lease Accounting, Data Extraction |
End User authentication for Lease Accounting Service and identity and access management for Crunchafi personnel. Used to authenticate employees and contractors to internal systems, enforce single sign-on, and apply conditional access and multi-factor authentication policies. Does not authenticate End Users of the Services. |
United States |
Provider’s EU SCCs and UK IDTA. |
Billing and Subscription Management
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Zone |
Lease Accounting, Data Extraction |
Subscription billing, invoicing, and payment processing for the Services. |
United States |
Provider’s EU SCCs and UK IDTA. |
| NetSuite |
Lease Accounting, Data Extraction |
Subscription billing, invoicing, and payment processing for the Services. |
United States |
Provider’s EU SCCs and UK IDTA. |
| Stripe |
Lease Accounting, Data Extraction |
Subscription billing, invoicing, and payment processing for the Services. Acts as an independent controller for payment-card data submitted directly to the provider. |
United States |
Provider’s EU SCCs and UK IDTA. |
| Avalara |
Lease Accounting, Data Extraction |
Sales tax calculation and reporting. |
United States |
Provider’s EU SCCs and UK IDTA. |
AI and Machine-Learning Services
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Microsoft Azure Open AI |
Lease Accounting |
Processing of Content submitted to AI-powered features (e.g., document extraction, classification, summarization). Provider is contractually prohibited from using Customer Personal Data to train its general-purpose models. Inputs and outputs not retained beyond the period required to deliver the response and meet the provider’s abuse-monitoring obligations. |
United States |
Provider’s EU SCCs and UK IDTA. |
| Anthropic |
Data Extraction |
Processing of Content submitted to AI-powered features (e.g., document extraction, classification, summarization). Provider is contractually prohibited from using Customer Personal Data to train its general-purpose models. Inputs and outputs not retained beyond the period required to deliver the response and meet the provider’s abuse-monitoring obligations. |
United States |
Provider’s EU SCCs and UK IDTA. |
Billing Operations and Accounts Receivable Support
| Sub-processor |
Crunchafi Service(s) |
Service Provided / Nature of Processing |
Location of Processing |
Transfer Mechanism |
| Team Prodigi – acting as Employer of Record for Pakistan-based billing operations personnel |
Lease Accounting and Data Extraction |
Customer-facing invoice processing, accounts receivable support, and handling of billing-related support tickets, in each case under Crunchafi’s direction. Personnel access is limited to Crunchafi’s billing and ticketing systems and does not extend to Customer Content within the Services. |
Pakistan (processing location); contracting entity may be domiciled outside Pakistan. |
EU SCCs (Module 3, processor-to-sub-processor) and UK IDTA, executed with Team Prodigi. Supplementary measures include role-based access, multi-factor authentication, no bulk data export, and access scoped to billing systems only. Transfer impact assessment on file. |
| Independent contractors engaged for Argentina-based billing operations personnel |
Lease Accounting and Data Extraction |
Customer-facing invoice processing, accounts receivable support, and handling of billing-related support tickets, in each case under Crunchafi’s direction. Personnel access is limited to Crunchafi’s billing and ticketing systems and does not extend to Customer Content within the Services. |
Argentina (processing location); contractors engaged directly by Crunchafi. |
EU SCCs (Module 3, processor-to-sub-processor) and UK IDTA, executed with each contractor. Supplementary measures include role-based access, multi-factor authentication, no bulk data export, and access scoped to billing systems only. Argentina is recognized by the European Commission as providing an adequate level of data protection. Transfer impact assessment on file. |
Notes
Restricted Transfers. Where Crunchafi’s engagement of a Sub-processor results in a Restricted Transfer (as defined in the DPA), Crunchafi has implemented an appropriate transfer mechanism in accordance with Section 9 of the DPA, including the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss addendum, or another lawful mechanism. The applicable mechanism for each Sub-processor is summarized in the “Transfer Mechanism” column. Transfer impact assessments are available to Customer on reasonable written request, subject to confidentiality.
Categories of Personal Data. The categories of Personal Data Processed by each Sub-processor are determined by the nature of the Services and the configuration in which Customer uses the Sub-processor. The categories of Personal Data Processed under this Schedule, taken as a whole, are described in Annex I of the DPA. Customer controls the actual Content uploaded to the Services and is responsible for the lawfulness and accuracy of the Personal Data submitted, in accordance with Section 3 of the DPA.
Special Categories of Data. Customer should not submit special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) to the Services. To the extent Customer does so, such data is Processed as part of Customer Personal Data and is subject to the same protections under the DPA.
Contact. Questions regarding this Schedule, requests to subscribe to change notifications, requests for transfer impact assessment summaries, and notices of objection under Section 6.4 of the DPA should be directed to privacy@crunchafi.com.
Version History
| Version |
Date |
Summary of Changes |
| 1.0 |
June 1, 2026 |
Initial publication of the Crunchafi Sub-processor Schedule, incorporated by reference into the DPA. |
