Didit engages the sub-processors listed below to Process Personal Data on behalf of its Clients as part of the Services. Their engagement is governed by Section 7 of the Data Processing Addendum (DPA), and this page is the list it refers to.
Each sub-processor is bound by data-protection obligations substantially similar to those in the DPA, and Didit remains liable for it. Where a sub-processor Processes Personal Data outside the European Economic Area (EEA), the transfer is made under an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or the European Commission's standard contractual clauses, as set out in Section 8 of the DPA.
1. Sub-processors for every Client
| Sub-processor | What it does for Didit | Personal Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, storage, databases and compute for the whole platform | All Personal Data Processed in the Services | Ireland (EU) |
| Postmark | Transactional email: verification links and reminders, email codes, notifications | Email address, name, message content | United States |
| Sentry | Error monitoring for the verification flow, the Business Console and the API | Error details: the error, the browser and device type, the page or API endpoint, and the session ID | United States |
| PostHog | Product analytics and session replay with personal data masked, for the verification flow and the Business Console | Usage events tied to the session ID; recordings of page layout, taps and scrolls with all text, form fields and images masked | United States |
What Sentry and PostHog receive from the verification flow. Only what keeps the flow working and helps improve it: the steps a person starts, completes or fails, the errors they hit, and recordings of the page's layout, taps and scrolls, tied to the session ID. Recordings never contain text, form fields, images, video or canvas, so they never hold camera images, document images, selfies or data read from documents. The verification link is removed from every page address, nothing is stored on the person's device, and IP addresses are not stored.
2. Sub-processors by Verification Feature
A Client's Personal Data reaches these sub-processors only when its workflows or integrations use the feature.
| Feature | Sub-processor | What it does for Didit | Personal Data | Location |
|---|---|---|---|---|
| ID verification, proof of address, location verification, questionnaires | Address search and structured addresses (Maps) | Addresses | Global | |
| AI assistant in the Business Console | OpenRouter | Routes the assistant's requests to the model provider | Assistant conversations, including the session data a user asks about | United States |
| AI assistant in the Business Console | Anthropic | Runs the assistant's language model (Claude) | Assistant conversations | United States |
| AI assistant in the Business Console | Braintrust | Records assistant conversations to measure answer quality | Assistant conversations | United States |
| Phone verification | Prelude | Sends phone verification codes by SMS | Phone number, IP address, device details | France (EU) |
| Phone verification, email verification | Monnai | Phone and email risk signals and identity enrichment | Name, email address, phone number, country | United States |
| Email verification | Have I Been Pwned | Checks whether an email address appears in known data breaches | Email address | United States |
| IP analysis | ipdata.co | IP risk: VPN, proxy, Tor and hosting detection | IP address | Global |
| Wallet screening with a Didit-managed key | Merkle Science | Screens crypto wallets for risk | Wallet addresses | United States |
Wallet screening with the Client's own provider key adds no Didit sub-processor: that provider works under the Client's own contract with it.
3. Changes and objections
Didit gives at least thirty (30) days' prior notice of an intended addition or replacement of a sub-processor by updating this page and, where the change affects a Service or Verification Feature the Client uses, by email to the email address associated with the Client's account. The Client may object on reasonable data-protection grounds by writing to privacy@didit.me within thirty (30) days of the notice, as set out in Section 7 of the DPA.
4. Contact
Data-protection questions: privacy@didit.me Data Protection Officer: dpo@didit.me