Heap Trust Center
Over 10,000 businesses trust Heap to power their analytics. Maintaining that trust is our paramount concern.
This page gives you access to relevant information regarding our approach to privacy, security, and compliance.
Sub-processors in use
The following lists table lists Heap’s current affiliates and third-party sub-processors who are authorized to process personal data in connection with the Heap Services:
Last Updated: July 2024
Sub-processor
Description of Processing
Country
Privacy Notice
Heap Core Software Services
Amazon Web Services (AWS)
Description of Processing
Hosts the Services and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup) Europe (at-rest only): Ireland (primary) and Sweden (backup)
Privacy Notice
Heap Session Replay Add-on
Google Cloud Platform
Description of Processing
Hosts the Session Replay add-on and Customer Data and backups
Country
Mountain View, USA For more information about Google’s data center locations, visit this link
Privacy Notice
Amazon Web Services (AWS)
Description of Processing
Hosts the Session Replay add-on and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup) Europe: Ireland (primary) and Sweden (backup)
Privacy Notice
Microsoft Azure
Description of Processing
Hosts the Session Replay add-on and Customer Data and backups
Country
USA: Virginia (primary) and Washington (backup) Europe: Ireland (primary) and Netherlands (backup)
Privacy Notice
Auryc
Description of Processing
Performs analytics and reporting on Customer Data
Country
Wilmington, USA
Privacy Notice
Contentsquare
Description of Processing
Performs analytics and reporting on Customer Data
Consulting, support, maintenance, implementation, and development
Country
Paris, France
Privacy Notice
Looker
Description of Processing
Performs analytics and reporting on Customer Data
Country
Mountain View, USA
Privacy Notice
Snowflake
Description of Processing
Hosts the Heap data lake and creates data analytics and reports of Customer Data
Country
Bozeman, USA
Privacy Notice
IBM
Description of Processing
IBM Performs analytics and reporting on Customer Data
Country
Armonk, USA
Privacy Notice
Hotjar
Description of Processing
Consulting, support, maintenance, implementation, and development
Country
Malta
Privacy Notice
HEAP VOICE-OF-CUSTOMER
Amazon Web Services (AWS)
Description of Processing
Hosts the Heap Voice-of-Customer and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup) Europe: Ireland (primary) and Sweden (backup)
Privacy Notice
HEAP AI (opt-in only)
Amazon Web Services (AWS)
Description of Processing
Hosts the Heap AI and Customer Data and backups
Country
USA: Virginia (primary) and Oregon (backup)
Privacy Notice
OpenAI
Description of Processing
Provides large language model
Country
San Francisco, USA
Privacy Notice
Heap Professional Services
Contentsquare
Description of Processing
Professional services partner
Country
Paris, France
Privacy Notice
Scaletrix
Description of Processing
Professional services partner
Country
Gurgaon, India
Privacy Notice
Definitions
“Heap Services” means the products and services provided by Heap to Customers under an agreement signed between them.
“Personal Data”, “Processing”, “Processor”, “Sub-processor” shall have the meaning as defined under applicable data protection laws.
Subscribing to updates from the sub-processor list
To subscribe to updates concerning Heap's Sub-processor List, please use this Request Form or send an email to privacy@contentsquare.com with a request to subscribe, and you will be provided with updates on any changes in this list.
Requesting more information about a sub-processor
For any additional information concerning Heap’s data processing practices or any specific Sub-processors, please send an email to privacy@contentsquare.com identifying the Sub-processor and the requested information.
Objecting to a sub-processor
A customer (in its capacity as Data Controller) may object to Heap’s use of a specific Sub-processor in accordance with the terms of the Data Processing Agreement governing the relations between the parties. Such objection may be sent by email to privacy@contentsquare.com (subject line “Sub-processor Objection”) containing the following information:
Customer Entity Name
Sub-processor Entity Name
Grounds for Objection
Requestor Name
Requestor Email
Objections must be based on legitimate data protection grounds in accordance with the terms of Heap’s standard Data Processing Agreement.