Legal · Last updated July 2026
Subprocessor List.
Per our Data Processing Agreement, the following third-party services may process client data on our behalf. We notify enterprise clients in writing before adding or replacing a subprocessor.
Vendor
Purpose
Data categories
Region
Pantheon Systems
WordPress & Drupal hosting platform
Site content, server logs, backups
United States
Acquia
Enterprise Drupal hosting (select clients)
Site content, server logs, personalization data
United States, EU
Amazon Web Services
Underlying cloud infrastructure
All data hosted on Pantheon & Acquia
United States, EU
Cloudflare
CDN, DDoS protection, edge cache
IP addresses, request metadata
Global edge
HubSpot
CRM, marketing automation, contact form intake
Contact name, email, organization, inquiry text
United States
Google Workspace
Email, calendars, internal documents
Internal communications, client correspondence
United States
Google Analytics 4
Web analytics on kwallcompany.com
Anonymized site usage, IP-truncated events
United States
Slack
Internal team communication
Project discussions, file shares
United States
Sentry
Error monitoring & performance tracing
Stack traces, user agent, sanitized request data
United States
GitHub
Source-code hosting, CI/CD
Code, deployment logs
United States
OpenAI
LLM inference for AI service engagements (opt-in per project)
Prompt + response content per the project’s data agreement
United States
Anthropic
LLM inference for AI service engagements (opt-in per project)
Prompt + response content per the project’s data agreement
United States
Project-specific subprocessors (e.g., a client’s chosen analytics or A/B tool) are documented in the relevant SOW. Enterprise clients receive 30 days’ notice before a new subprocessor is added to the production stack; objection rights and termination remedies are governed by the DPA.
