D

Directus

Directus is an open-source headless CMS and API platform for developers, providing tools to manage content and data across various frameworks.

vendor	purpose	evidence
A Amazon Web Services US, EU, Asia-Pacific	Directus Cloud SaaS	“Amazon Web Services (AWS) Directus Cloud SaaS Client Selected Data Center Region Multiple regions available: US, EU, Asia-Pacific, etc. Database, Directus Node Hosting & Fallback Transactional Emails Cloud infrastructure services including: Compute (EC2), managed databases (RDS), object storage (S3), block storage (EBS), SES fallback transactional emails, load balancing, VPC networking, and backup services. All data encrypted at rest using envelope encryption and in transit using TLS 1.3+ AWS SES serves as automatic failover for transactional emails.” source
C Cloudflare, Inc Global	Global CDN for Directus Cloud SaaS projects	“Cloudflare Global CDN for Directus Cloud SaaS projects Global network and traffic processing. Traffic routing uses Cloudflare's global anycast network. Global CDN - All traffic passes through for DDoS protection and WAF; TLS termination and re-encryption; Load balancing and traffic routing; Only client-configured PUBLIC content is cached; Private/authenticated content transits but is NOT cached or stored” source
G Google USA	Cloud storage, secure file sharing, and internal workspace services	“Google Cloud storage, secure file sharing, and internal workspace services to facilitate support ticket management and log transfers. USA Type of data Processed: Highly variable depending on the contents of the files shared by the client. Typically includes IT-related PII such as IP addresses, email addresses, usernames, device IDs, system logs, and network architecture details. Cases in which Sub-Processor has access: Google systems programmatically process the data to provide the storage service. Human access by Google personnel is strictly prohibited except when legally compelled or explicitly authorized by our team for a support escalation. Technical restrictions include data encryption in transit (TLS) and at rest (AES-256), coupled with strict internal Identity and Access Management (IAM) and Zero Trust architecture. Alternatives: Client may provide their own secure share location to facilitate transfers.” source
H HubSpot US	Customer Relationship Management (CRM) and support ticketing system	“HubSpot Customer Relationship Management (CRM) and support ticketing system to track, manage, and communicate with authorized client support contacts, including the ingestion and hosting of client-initiated support requests and associated correspondence. US Basic contact information limited to email addresses and (optionally) first/last names of authorized support users.” source
N Northflank US, EU, Asia-Pacific	Directus Cloud SaaS	“Northflank Directus Cloud SaaS Client Selected Data Center Region Multiple regions available: US, EU, Asia-Pacific, etc. Application Hosting, Managed Databases & Object Storage. Cloud infrastructure services including: Compute (Directus Service), managed databases (PostgreSQL), in-memory cache (Redis), and object storage (MinIO). All data encrypted at rest using Google Cloud default encryption (AES-256) and in transit using TLS 1.2+.” source
S SendGrid USA, EU	Transactional Email Delivery for Directus SaaS projects	“SendGrid Transactional Email Delivery for Directus SaaS projects USA, EU Transactional Email Delivery Only. Email composition and template rendering performed by Directus using Liquid.js. SendGrid/SES provide SMTP relay, delivery, bounce handling, and delivery analytics. Scan outgoing emails for spam/abuse compliance. Enterprise clients may configure their own SMTP provider to bypass SendGrid processing.” source
S Stripe USA	Payment gateway, subscription billing management, invoicing, and fraud prevention	“Stripe Payment gateway, subscription billing management, invoicing, and fraud prevention for the Self-Serve cloud platform. USA Billing contact information (Name, Email, Billing Address), IP address and device data (for fraud detection), and tokenized financial data (Credit/Debit Card details, Bank Account information).” source

• A

  Amazon Web Services

  US, EU, Asia-Pacific

  Directus Cloud SaaS

  “Amazon Web Services (AWS) Directus Cloud SaaS Client Selected Data Center Region Multiple regions available: US, EU, Asia-Pacific, etc. Database, Directus Node Hosting & Fallback Transactional Emails Cloud infrastructure services including: Compute (EC2), managed databases (RDS), object storage (S3), block storage (EBS), SES fallback transactional emails, load balancing, VPC networking, and backup services. All data encrypted at rest using envelope encryption and in transit using TLS 1.3+ AWS SES serves as automatic failover for transactional emails.” source

• C

  Cloudflare, Inc

  Global

  Global CDN for Directus Cloud SaaS projects

  “Cloudflare Global CDN for Directus Cloud SaaS projects Global network and traffic processing. Traffic routing uses Cloudflare's global anycast network. Global CDN - All traffic passes through for DDoS protection and WAF; TLS termination and re-encryption; Load balancing and traffic routing; Only client-configured PUBLIC content is cached; Private/authenticated content transits but is NOT cached or stored” source

• G

  Google

  USA

  Cloud storage, secure file sharing, and internal workspace services

  “Google Cloud storage, secure file sharing, and internal workspace services to facilitate support ticket management and log transfers. USA Type of data Processed: Highly variable depending on the contents of the files shared by the client. Typically includes IT-related PII such as IP addresses, email addresses, usernames, device IDs, system logs, and network architecture details. Cases in which Sub-Processor has access: Google systems programmatically process the data to provide the storage service. Human access by Google personnel is strictly prohibited except when legally compelled or explicitly authorized by our team for a support escalation. Technical restrictions include data encryption in transit (TLS) and at rest (AES-256), coupled with strict internal Identity and Access Management (IAM) and Zero Trust architecture. Alternatives: Client may provide their own secure share location to facilitate transfers.” source

• H

  HubSpot

  US

  Customer Relationship Management (CRM) and support ticketing system

  “HubSpot Customer Relationship Management (CRM) and support ticketing system to track, manage, and communicate with authorized client support contacts, including the ingestion and hosting of client-initiated support requests and associated correspondence. US Basic contact information limited to email addresses and (optionally) first/last names of authorized support users.” source

• N

  Northflank

  US, EU, Asia-Pacific

  Directus Cloud SaaS

  “Northflank Directus Cloud SaaS Client Selected Data Center Region Multiple regions available: US, EU, Asia-Pacific, etc. Application Hosting, Managed Databases & Object Storage. Cloud infrastructure services including: Compute (Directus Service), managed databases (PostgreSQL), in-memory cache (Redis), and object storage (MinIO). All data encrypted at rest using Google Cloud default encryption (AES-256) and in transit using TLS 1.2+.” source

• S

  SendGrid

  USA, EU

  Transactional Email Delivery for Directus SaaS projects

  “SendGrid Transactional Email Delivery for Directus SaaS projects USA, EU Transactional Email Delivery Only. Email composition and template rendering performed by Directus using Liquid.js. SendGrid/SES provide SMTP relay, delivery, bounce handling, and delivery analytics. Scan outgoing emails for spam/abuse compliance. Enterprise clients may configure their own SMTP provider to bypass SendGrid processing.” source

• S

  Stripe

  USA

  Payment gateway, subscription billing management, invoicing, and fraud prevention

  “Stripe Payment gateway, subscription billing management, invoicing, and fraud prevention for the Self-Serve cloud platform. USA Billing contact information (Name, Email, Billing Address), IP address and device data (for fraud detection), and tokenized financial data (Credit/Debit Card details, Bank Account information).” source