COMMONSPACE SUB-PROCESSOR LIST
Last Updated: March 26, 2026
This page lists the current Sub-processors authorized to process Personal Data on behalf of Space Owner Controllers under the Commonspace Data Processing Addendum ("DPA"). This list is maintained in accordance with Section 7.3 of the DPA.
Commonspace may add or replace Sub-processors within an already-authorized category with at least 14 days' notice. Engaging a Sub-processor in a new category requires at least 30 days' notice. Notice is sent to the email associated with your Space Owner account. If you have a reasonable objection based on data protection grounds, you may notify us in writing within 15 days of receiving notice at privacy@common.space.
Core Platform Sub-processors
The following Sub-processors are active for all Spaces on the platform.
Cloud Infrastructure & Hosting
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Servers, storage, databases (S3, EC2, RDS) | United States (us-west-1) | All Personal Data stored in the Services | At launch |
| Cloudflare, Inc. | CDN, DDoS protection, DNS, network security | United States | IP addresses, request metadata | At launch |
Payment Processing & Identity Verification
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, identity verification | United States | Member payment and transaction data, identity verification data | At launch |
Communication & Messaging
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Twilio, Inc. | SMS-based two-factor authentication | United States | Phone numbers (for Members who enable SMS 2FA) | At launch |
| SendGrid (Twilio) | Transactional email delivery | United States | Email addresses, email content | At launch |
| Expo (650 Industries) | Mobile app build and push notifications | United States | Push notification tokens, device identifiers | At launch |
| Google Firebase (Google LLC) | Android push notifications (FCM) | United States | Device tokens, notification payloads | At launch |
| Apple Inc. | iOS app distribution and push notifications (APNs) | United States | Device tokens, notification payloads | At launch |
Security & Fraud Prevention
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Google LLC | reCAPTCHA Enterprise (bot detection, fraud prevention) | United States | IP address, interaction data | At launch |
Mapping & Location Services
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Google LLC | Google Maps (address lookup, location display) | United States | Location data | At launch |
Optional Space Plugin Sub-processors
The following Sub-processors are only active for Spaces where the Controller has enabled the relevant Plugin. Personal Data is only processed for Members who actively opt in to use the Plugin within a Space.
| Sub-processor | Purpose | Location | Data Processed | Effective Date |
|---|---|---|---|---|
| Zoom Video Communications | Video conferencing for Space events | United States | Display name, meeting metadata, audio/video data | At launch |
| Discord | Community chat integration | United States | Display name, profile information, messages | At launch |
| Shopify | E-commerce integration for Space stores | United States | Display name, transaction data, shipping information | At launch |
| WhatsApp (Meta Platforms) | Messaging integration | United States / EU | Display name, phone number, messages | At launch |
The current list of available Plugins is maintained at https://help.common.space/legal/plugins.
Questions
For questions about this Sub-processor list or Commonspace's data processing practices, contact privacy@common.space.