Trust
Tagmaps Subprocessors
Effective date: August 22, 2026
Last updated: August 22, 2026
This page is the authoritative list of third parties that Tagmaps, LLC engages to process Customer Personal Data for the scanning Service. It uses “Subprocessor” in the narrower sense defined by the Data Processing Agreement. Providers that process Personal Information only for Tagmaps’ own billing, Website analytics, marketing, or customer-relationship purposes are listed separately below.
Customer Personal Data subprocessors
| Vendor | Purpose | Primary processing locations |
|---|---|---|
| Amazon Web Services, Inc. and affiliates (AWS) | Primary cloud hosting; databases and object storage; identity infrastructure; transactional email; queues; logging; content delivery; secrets management; backups; and artificial-intelligence inference through Amazon Bedrock. | Primarily United States. Customer-selected scan execution may occur in the United States, Ireland, the United Kingdom, or Brazil. |
Each Subprocessor is engaged under written data-protection and security terms. Tagmaps remains responsible for its Subprocessors as described in the DPA.
Amazon Bedrock
Tagmaps may use Amazon Bedrock to classify technical scan artifacts. AWS provides and controls the inference environment. Under AWS’s Bedrock data-protection documentation, model providers do not have access to customer prompts or completions. Tagmaps does not enable a retention mode that shares Customer Personal Data with a model provider.
Customer-directed recipients
The Service is inactive against a website, Google resource, or other external system until Customer gives the relevant instruction. Customer chooses scan targets, consent actions, third-party endpoints, connected Google identities, and Google Tag Manager resources.
A Customer-selected website, script, endpoint, Google resource, or other integration recipient is not a Tagmaps Subprocessor solely because the Service sends a Customer-directed request or data inherent in that operation to it. Customer is responsible for authorizing those instructions and for its relationship with the recipient.
Google LLC and its affiliates receive Google OAuth and Google Tag Manager requests when Customer enables the integration. Google processes those requests under Customer's Google relationship and Google's applicable terms. Tagmaps lists resources visible to the connected identity and performs only the operations an authorized administrator selects. The Privacy Policy explains the Google API data flow and restrictions.
The Service may also request a public favicon from Google or another Customer-directed recipient using a normalized cookie domain or script hostname. These requests use a generic browser identifier and do not include a Tagmaps account or scan identifier. Returned images are cached in AWS.
Providers for Tagmaps’ controller purposes
The following providers support Tagmaps’ own controller activities. They are not authorized by this list to process Customer Personal Data for the scanning Service:
| Vendor | Controller purpose |
|---|---|
| Stripe, Inc. | Payment processing, billing, and subscription management. |
| Peaberry Software, Inc. (Customer.io) | Marketing and lifecycle email; Website visitor identification where consent permits. |
| PostHog, Inc. | Consented Website traffic and product-usage analytics. |
| Attio, Inc. | Sales and customer-relationship management. |
AWS also supports controller activities described in the Privacy Policy. Its inclusion in the Subprocessor table is limited to the Customer Personal Data purposes stated there.
Changes and objections
Tagmaps will give active Customers reasonable advance notice before a new or replacement Subprocessor begins processing Customer Personal Data. Notice may be sent to the primary account-administrator email or shown conspicuously in the Service. If an urgent security, legal, or service-continuity issue makes advance notice impracticable, Tagmaps will give notice promptly afterward.
A Customer may object before the new Subprocessor begins processing based on reasonable data-protection grounds. The resolution and termination process is in Section 3 of the DPA.
Contact
legal@tagmaps.io for questions about this list, an objection notice, or the underlying contractual protections.