Sub-Processor List

VerifyLive®

The Transaction Trust Platform

SUB-PROCESSOR LIST

Published companion to the Data Processing Addendum

Version 1.1 — FINAL

Effective April 22, 2026

verifylive.net/legal/subprocessors

VerifyLive LLC • [email protected]

About This List

VerifyLive LLC (“VerifyLive”) engages a limited number of trusted third-party service providers (“Sub-Processors”) to deliver the Service to Merchants. This list identifies each Sub-Processor, the purpose of the Processing, the categories of Merchant Personal Data involved, and the location(s) and cross-border transfer safeguards that apply.

This list is maintained as the authoritative Sub-Processor register referenced in the VerifyLive Data Processing Addendum (Exhibit B to the Merchant Services Agreement). It is published at verifylive.net/legal/subprocessors and updated whenever a Sub-Processor is added, replaced, or removed.

How Changes Are Notified

When VerifyLive adds or replaces a Sub-Processor, Merchant receives at least thirty (30) days’ prior notice, delivered by email to the Merchant account administrator and by updating this published list. Merchant has fifteen (15) days from the notice date to object on reasonable data-protection grounds; objection procedure is governed by Section 6.4 of the DPA.

Categories of Sub-Processors

• Infrastructure & Hosting — cloud platforms hosting the Service and its data stores
• Security & Network — edge security, WAF, DDoS protection, bot management
• Platform Adapters — integrations with Merchant-facing commerce platforms
• Signal Providers — external fraud/identity signal sources
• Payments — settlement of Chargeback Guarantee payouts
• AI Reasoning — large-language-model providers used for fraud-pattern reasoning
• Productivity & Support — corporate email, support ticketing, source control

Current Sub-Processors — Effective April 22, 2026

The following Sub-Processors are engaged by VerifyLive as of the Effective Date. All Sub-Processors are bound by written data-protection terms that are no less protective than the obligations set forth in VerifyLive’s DPA with Merchant.

Sub-Processor (Legal Entity)

Category

Purpose of Processing

Data Categories

Location / Safeguard

Microsoft Corporation (Microsoft 365, Entra ID)

Productivity & Support

Corporate email, identity/SSO for VerifyLive personnel, support ticketing

Merchant contact identifiers, support correspondence

US/EU; EU SCCs via Microsoft DPA

Google LLC (Google Cloud Platform)

Infrastructure & Hosting

ML model training infrastructure, operational logging, analytics

De-identified training data, operational telemetry

US/EU; EU SCCs via GCP DPA

Cloudflare, Inc.

Security & Network

Edge network, WAF, DDoS protection, bot management

IP addresses, request metadata, tokenized signals

Global edge/US; EU SCCs via Cloudflare DPA

Railway Corp.

Infrastructure & Hosting

Inference hosting for real-time fraud-detection models

Request-time tokenized feature vectors

United States; EU SCCs via Railway DPA

Render Services, Inc.

Infrastructure & Hosting

Core API and merchant dashboard application hosting

Encrypted Merchant Personal Data at rest, session data

United States; EU SCCs via Render DPA

MaxMind, Inc. (minFraud)

Signal Providers

Geolocation and IP-reputation signals for fraud scoring

IP address, device signals, request metadata

United States; EU SCCs via MaxMind DPA

Stripe, Inc. (Stripe Connect)

Payments

Settlement of Chargeback Guarantee payouts to Merchants

Merchant payout identifiers, settlement amounts, bank references

US/EU; EU SCCs via Stripe DPA

Shopify Inc.

Platform Adapters

Commerce-platform adapter (Shopify Merchants only)

Order, customer, and product metadata from Merchant store

Canada/US; EU SCCs via Shopify DPA

Block, Inc. (Square)

Platform Adapters

Commerce-platform adapter (Square Merchants only)

POS, invoice, appointment, and customer metadata

United States; EU SCCs via Square DPA

Anthropic, PBC

AI Reasoning

Large-language-model provider used for fraud-pattern reasoning

De-identified signal summaries; no direct identifiers

United States; API with zero-retention configuration

Google LLC (Generative AI API)

AI Reasoning

Large-language-model provider used for fraud-pattern reasoning

De-identified signal summaries; no direct identifiers

United States; API with zero-retention configuration

X.AI Corp.

AI Reasoning

Large-language-model provider used for fraud-pattern reasoning

De-identified signal summaries; no direct identifiers

United States; API with zero-retention configuration

Infrastructure Vendors That Do Not Process Merchant Personal Data

The following vendors support VerifyLive’s corporate operations and engineering workflow but do not Process Merchant Personal Data. They are disclosed here for transparency. Because they are not Sub-Processors of Merchant Personal Data, they are not subject to the thirty (30) day prior-notice requirement in Section 6.4 of the DPA, and changes to this footnote list are not treated as Sub-Processor changes for DPA purposes.

• GitHub, Inc. (a Microsoft subsidiary) — source control, continuous integration, and automated security scanning. Processes engineering metadata and source code only. No Merchant Personal Data is stored in, or transmitted through, GitHub.
• Vercel Inc. — hosting for the VerifyLive marketing website and public documentation at verifylive.net. Processes website-visitor analytics and marketing form submissions at the corporate-website layer only. No Merchant Personal Data collected through the VerifyLive Service is stored in, or transmitted through, Vercel.

If VerifyLive at any time begins routing Merchant Personal Data through either of these vendors, the vendor will be promoted to the primary Sub-Processor table and the change will be announced with thirty (30) days’ prior notice in accordance with DPA Section 6.4.

Not Currently Engaged

VerifyLive does not currently engage any Sub-Processor located in a jurisdiction lacking an adequacy decision or equivalent safeguard mechanism, other than as described above with the EU SCCs (and, for UK transfers, the UK Addendum) applied. VerifyLive does not currently transfer Merchant Personal Data to the People’s Republic of China, the Russian Federation, or any jurisdiction subject to a comprehensive U.S. trade embargo.

Affiliates of VerifyLive

VerifyLive does not currently engage any corporate affiliate as a Sub-Processor. If VerifyLive forms a subsidiary or affiliate that will Process Merchant Personal Data, the entity will be added to this list in accordance with the notice procedure described above.

Change History

This change history records all material changes to the Sub-Processor List and the effective date of each change.

Version

Effective Date

Change

Notice Method

1.0 FINAL

April 22, 2026

Initial publication of the VerifyLive Sub-Processor List. Fourteen Sub-Processors identified across seven categories.

Published at verifylive.net/legal/subprocessors; announced via DPA Exhibit B v1.0 FINAL.

1.1 FINAL

April 22, 2026

Demoted GitHub, Inc. (source control / engineering metadata only) and Vercel Inc. (corporate marketing-site hosting only) from the primary Sub-Processor table to a new “Infrastructure Vendors That Do Not Process Merchant Personal Data” footnote. No addition, removal, or scope change to any actual Sub-Processor of Merchant Personal Data; primary table now lists twelve (12) Sub-Processors. Classification change only — not a Sub-Processor change for DPA Section 6.4 purposes.

Published at verifylive.net/legal/subprocessors; no thirty-day notice required because no Sub-Processor of Merchant Personal Data was added or changed.

Contact & Further Information

Questions about this list, requests for additional detail about a Sub-Processor’s data-protection posture, or objections to a new Sub-Processor (under Section 6.4 of the DPA) may be directed to:

VerifyLive LLC

Attn: Privacy

119 S Western Ave Unit 1, Chicago, Illinois 60612

[email protected]

Merchants are also encouraged to subscribe to the Sub-Processor update notification list in the VerifyLive console to receive automated notice of changes to this list.