Legal
Payment Kit subprocessor and service provider list
Effective date: June 23, 2026
Payment Kit LLC (“Payment Kit”) uses the providers below to support the Payment Kit services. Providers designated as subprocessors may process Customer Personal Data on behalf of Payment Kit. Applicability depends on the products, features, and configurations used by a customer.
Customer-selected payment processors, gateways, acquiring banks, card networks, payment-method providers, fraud providers, and other services selected, contracted for, or controlled by a customer are not Payment Kit subprocessors solely because Payment Kit facilitates an integration with or transmits data to them at the customer’s direction.
Current providers
- Very Good Security, Inc. (VGS)Subprocessor
- Purpose and personal data: Payment credential tokenization, secure vaulting, and secure data relay. Payment-card data, tokens, billing/contact data, and routing metadata.
- Processing locations / applicability: United States and other locations described in VGS documentation or selected through the Services.
- Google LLC (Google Cloud Platform)Subprocessor
- Purpose and personal data: Cloud hosting, compute, storage, databases, networking, backups, logging, and security. Customer Personal Data hosted in the Services.
- Processing locations / applicability: United States and configured Google Cloud regions.
- Twilio Inc. (SendGrid)Subprocessor
- Purpose and personal data: Transactional email and related communications. Recipient names, email addresses, message content, and delivery metadata.
- Processing locations / applicability: United States and other locations described in Twilio’s DPA.
- OpenAI, L.L.C.Conditional Subprocessor
- Purpose and personal data: AI-enabled features and workflows. Prompts, inputs, outputs, related metadata, and any Customer Personal Data included in those materials.
- Processing locations / applicability: United States and other supported/configured regions; applies only when AI-enabled functionality is used.
- Vercel Inc.Subprocessor
- Purpose and personal data: Application and frontend hosting, deployment, content delivery, and performance. IP addresses, request/device data, session data, and content handled by hosted applications.
- Processing locations / applicability: United States and global edge locations.
- Functional Software, Inc. d/b/a SentrySubprocessor
- Purpose and personal data: Error tracking, monitoring, debugging, and performance. Error logs, identifiers, IP/device data, application metadata, and data included in diagnostic events.
- Processing locations / applicability: United States or Europe, depending on configuration.
- Dropbox, Inc. (Dropbox Sign, formerly HelloSign)Business Operations Service Provider
- Purpose and personal data: Electronic signatures and agreement execution. Business contact information, signature records, audit trails, and contract documents.
- Processing locations / applicability: United States and other locations described in Dropbox terms. Ordinarily used for contracting rather than core end-customer data processing.
Changes and notices
Payment Kit may add, replace, or remove providers as the Services evolve. Payment Kit will update this page and provide any additional notice required by the Payment Kit Data Processing Addendum or applicable law. Customers may request notice of Subprocessor changes by emailing legal@paymentkit.com.
Contact
Payment Kit LLC, Attn: Legal and Privacy, 1111B S Governors Ave STE 47765, Dover, DE 19904.
legal@paymentkit.com
privacy@paymentkit.com