Sub-Processors
Last updated: March 25, 2026
This page lists the sub-processors authorised by Spwig to process personal data on behalf of merchants, as described in the Data Processing Agreement (DPA). Spwig will update this list when sub-processors change and will provide 30 days' prior notice before engaging a new sub-processor.
Authorised Sub-Processors
The following sub-processors are authorised as of March 25, 2026:
| Sub-Processor | Location | Processing Activity |
|---|---|---|
| Akamai Technologies / Linode | Varies by region (Frankfurt, Singapore, Newark, and other Akamai data centre locations) | Infrastructure hosting, compute, storage, and networking for hosted merchant environments and Spwig-operated services |
| Cloudflare, Inc. | Global edge network | DNS management, SSL/TLS termination, DDoS protection, and CDN for hosted merchant environments |
| Airwallex Pty Ltd | Singapore / varies | Payment processing for Spwig merchant subscription billing (processes billing identity and tokenised payment data on behalf of Spwig as controller — included for transparency, though this is controller processing) |
Self-Hosted Service Sub-Processors
For self-hosted installations, the Spwig-operated services (GeoIP, Geocoder, Push, SSO, Update Server) run on infrastructure provided by the sub-processors listed above (primarily Akamai/Linode). No additional sub-processors are used for self-hosted service interactions.
Merchant-Selected Providers
Payment providers, shipping providers, translation providers, email providers, and other third-party integrations selected and configured by the merchant within their own store are not Spwig sub-processors. The merchant contracts with those providers directly.
Changes to Sub-Processors
Before engaging a new sub-processor, Spwig will:
- Notify the merchant by email at least 30 days before the new sub-processor begins processing personal data.
- Provide the name, location, and description of processing for the new sub-processor.
- Allow merchants 14 days to raise a reasonable, documented objection on data protection grounds.
For full details on sub-processor obligations, objection rights, and data protection terms, see the Data Processing Agreement.