Heap Trust Center
Over 10,000 businesses trust Heap to power their analytics. Maintaining that trust is our paramount concern.
This page gives you access to relevant information regarding our approach to privacy, security, and compliance.
Sub-processors in use
The following lists table lists Heap’s current affiliates and third-party sub-processors who are authorized to process personal data in connection with the Heap Services:
Last Updated: November 2024
Sub-processor
Description of Processing
Country
Privacy Notice
Heap Core Software Services
Amazon Web Services (AWS)
Description of Processing
Hosts the Services and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup) Europe (at-rest only): Frankfurt, Germany
Privacy Notice
Zendesk, Inc.
Description of Processing
Provides a customer service platform
Country
San Francisco, USA
Privacy Notice
Heap Session Replay Add-on
Auryc
Description of Processing
Performs analytics and reporting on Customer Data within the Session Replay add-on
Country
Wilmington, USA
Privacy Notice
Google Cloud Platform
Description of Processing
Hosts the Session Replay add-on and Customer Data and backups
Country
Mountain View, USA For more information about Google’s data center locations, visit this link
Privacy Notice
Looker Studio (Google)
Description of Processing
Performs analytics and reporting on Customer Data within the Session Replay add-on
Country
Mountain View, USA
Privacy Notice
HEAP VOICE-OF-CUSTOMER (VOC) ADD-ON
Auryc
Description of Processing
Performs analytics and reporting on Customer Data within the VOC add-on
Country
Wilmington, USA
Privacy Notice
Google Cloud Platform
Description of Processing
Hosts the VOC add-on and Customer Data and backups
Country
Mountain View, USA
For more information about Google’s data center locations, visit this link
Privacy Notice
IBM
Description of Processing
Performs analytics and reporting on Customer Data within the VOC
Country
Armonk, USA
Privacy Notice
HEAP CONNECT (opt-in only)
Snowflake
Description of Processing
Hosts the Services and Customer Data and backups (“Heap-Hosted Snowflake”)
Gives access to data analytics and reports of Customer Data in their Snowflake instance (“Snowflake integration”)
Country
Bozeman, USA
Privacy Notice
HEAP AI (opt-in only)
Amazon Web Services (AWS)
Description of Processing
Hosts the Heap AI and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup)
Privacy Notice
OpenAI
Description of Processing
Provides large language model
Country
San Francisco, USA
Privacy Notice
Heap Professional Services
Scaletrix
Description of Processing
Professional services partner
Country
Gurgaon, India
Privacy Notice
Following an internal assessment, we identified the absence of some of the vendors in the list above which may be different from a previous version; Heap has always used these vendors for the identified purpose, they are not new sub-processors.
Definitions
“Heap Services” means the products and services provided by Heap to Customers under an agreement signed between them.
“Personal Data”, “Processing”, “Processor”, “Sub-processor” shall have the meaning as defined under applicable data protection laws.
Subscribing to updates from the sub-processor list
To subscribe to updates concerning Heap's Sub-processor List, please use this Request Form or send an email to privacy@contentsquare.com with a request to subscribe, and you will be provided with updates on any changes in this list.
Requesting more information about a sub-processor
For any additional information concerning Heap’s data processing practices or any specific Sub-processors, please send an email to privacy@contentsquare.com identifying the Sub-processor and the requested information.
Objecting to a sub-processor
A customer (in its capacity as Data Controller) may object to Heap’s use of a specific Sub-processor in accordance with the terms of the Data Processing Agreement governing the relations between the parties. Such objection may be sent by email to privacy@contentsquare.com (subject line “Sub-processor Objection”) containing the following information:
Customer Entity Name
Sub-processor Entity Name
Grounds for Objection
Requestor Name
Requestor Email
Objections must be based on legitimate data protection grounds in accordance with the terms of Heap’s standard Data Processing Agreement.