See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers. Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons. ANNEX III List Of Sub-Processors (current list is in this Packet and at https://trust.relayto.com/; last updated 20 September 2026) Authorized Sub-processors as of 20 September 2026. Customer may object to a new Sub-processor within 30 calendar days of notice under DPA section 4.3. Notice will be posted at https://trust.relayto.com/ and/or emailed to the Customer admin. • Amazon Web Services (AWS) — hosting, compute, storage, CDN — Ireland primary / US / UAE if specified — Stored Data and Account Data. • MongoDB Atlas — cloud database — EU primary / US / UAE if specified — Stored Data and Account Data. • Cloudflare — WAF, DDoS, CDN, edge security — global edge. • GitHub — source code hosting and review — United States — employee/contractor code; not production Stored Data. • Slack — internal operations messaging — United States — name, email, id if used in support threads. • OpenAI — AI Content Chat, AI Agent, and generation inference when selected — United States — prompts and content snippets needed to generate a response. No training on Customer content. • Anthropic (Claude) — AI-assisted content creation, microsite builder, and other generation workflows when selected — United States — prompts and content snippets needed to generate a response. No training on Customer content. • Google — email, workspace, analytics infrastructure — EU primary / US if specified — name, email, id. • HubSpot — CRM — Ireland primary / US if specified — name, email, id. • Intercom — customer support — United States — name, email, id. • Segment — analytics pipeline — United States — user id. • Mixpanel — product analytics — United States — user id. • Rollbar — error / log management — United States — user id. • Asana — internal project management — United States • DocuSign — e-signature — UK primary / US if specified — name, email. • Stripe — payment processing — UK primary / US if specified — name, email, payment data if paid via Stripe. • SendGrid — transactional email — UK primary / US if specified — name, email. 38 of 53