Triad Global Triad Core

Sub-processors

Last updated 13 October 2026. The third parties that may process personal data in Triad Core on behalf of our customers, what for, and where. We announce a new one at least 30 days before it starts (see the data processing addendum).

Always used

  • Google LLC (Google Cloud Platform): hosting (Cloud Run), database (Cloud SQL for PostgreSQL), file storage, backups, logs and secret storage. Location: United States, us-east4 (Northern Virginia).

Used only when the customer switches the feature on

  • Google LLC (Vertex AI, Gemini models): Triad AI answers and proposals. Location: Vertex AI's global endpoint, so a request may be processed in a Google Cloud region outside the United States. Google Cloud terms do not allow training Google models on customer data.
  • Anthropic, PBC (Claude models): Triad AI answers and proposals, only when Triad Global runs Triad AI on Anthropic instead of Google. Location: United States. Anthropic's commercial terms do not allow training its models on customer data.
  • Google LLC (Google Identity): Sign in with Google, for people who choose it. Location: global.
  • Google LLC (Gmail API, Google Calendar API): mailboxes and calendars a person chooses to connect. Scopes asked for: openid, email, gmail.send and calendar.events.owned.readonly, plus gmail.readonly only for organisations whose Google Workspace admin approved Triad Core. Location: global (Google's mail infrastructure).
  • Microsoft Corporation (Microsoft Graph): Microsoft 365 mailboxes a person chooses to connect. Permissions asked for: User.Read, Calendars.Read, Mail.ReadWrite, Mail.Send, Mail.ReadWrite.Shared, Mail.Send.Shared and offline_access. Location: per the customer's Microsoft 365 tenant.
  • Google LLC (Google Workspace mail) or Resend, Inc.: delivery of service emails (invitations, password resets, approvals, notifications, documents sent to a customer's contacts), through whichever of the two Triad Global has switched on. Location: United States (Resend); Google's mail infrastructure (Google Workspace).
  • LinkHub Co., Ltd. (Popbill) and Bolta (bolta.io): Korean electronic tax invoices, and cash receipts where switched on, when a company issues them through Triad Global's provider account. They receive the invoice details, including the buyer's business name, registration number and tax email. Location: Republic of Korea.

Not sub-processors

Integrations a customer sets up itself in the Connection Center (for example its own accounting system, its own Stripe, Popbill or Bolta account, or webhook endpoints) receive data on the customer's instruction and are the customer's own providers.

Stripe, Inc. handles Triad Global's own billing of Triad Core subscriptions (billing contacts and payment details, entered on Stripe's pages; Triad Core never sees card numbers). For that billing data Triad Global is the controller, so Stripe is Triad Global's provider, not a sub-processor of workspace records.

Services that receive no personal data

  • European Central Bank: daily reference exchange rates, downloaded by Triad Core. Nothing is sent but the request.
  • Twelve Data: live exchange rates, when switched on. Only currency codes are sent.
  • YouTube (Google LLC): some guide videos play from youtube-nocookie.com when a person presses play. The viewer's browser connects to YouTube; no workspace records are sent.

Updates

To be told about changes, ask office@triadglobal.org to add your administrator to the notice list; customer administrators are on it by default.

Sub-processors · Triad Core