Loupe Cloud-Hosted Sub-processors
Last updated: 11 November 2026
This page lists the sub-processors that Gibraltar Software, Inc. uses to process Customer Personal Data when providing Loupe Cloud-Hosted, as described in our Data Processing Addendum (DPA Clause 6 and Annex III).
Current sub-processors
| Sub-processor | Purpose and data | Location | Transfer safeguard / terms |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Cloud hosting (compute, Azure SQL Database, Azure Service Bus, storage and networking) for us.onloupe.com and hub.gibraltarsoftware.com (Loupe user accounts for all customers) | United States: Azure US East 2 (Virginia) | Microsoft Products and Services Data Protection Addendum |
| Microsoft Corporation (Microsoft Azure) | Cloud hosting for the EU instance (europe.onloupe.com), including its backups | EU: Azure West Europe (Netherlands); backups stored in the EU | As above |
| Twilio Inc. (SendGrid) | Email delivery for notifications and alerts, which may contain log excerpts | United States | EU SCCs (and UK and Swiss equivalents) in the Twilio Data Protection Addendum |
| Freshworks Inc. (Freshdesk) | Customer support ticketing for paying customers: Support Data, including any attached logs, retained for 3 years after the ticket is closed (see DPA Clauses 11.4 and 13.3) | United States | EU SCCs in the Freshworks data protection terms, and/or Freshworks’ EU-U.S. DPF certification (including the UK Extension and Swiss-U.S. DPF) |
| PostHog, Inc. | Product analytics of usage metadata from the Loupe web application (features used, pages viewed and timestamps, linked to a Loupe user identifier); never log content (DPA Clause 3.4). Retained for 24 months, or deleted earlier on Customer’s request (DPA Clause 13.3) | United States (PostHog US Cloud) | EU SCCs (Module 2), UK Addendum and Swiss adaptations in the PostHog DPA, and PostHog’s EU-U.S. DPF certification (including the UK Extension and Swiss-U.S. DPF) |
Gibraltar’s own service providers for its commercial relationship with you (for example, its payment provider) are not sub-processors (DPA Clause 2.2).
Changes to sub-processors
We give at least 30 days’ notice before a new sub-processor (including a replacement) begins processing Customer Personal Data. We email the notice to your Customer Contact (the billing contact on My.OnLoupe.com or, if there is none, your account owner) and post the change on this page. Please keep your billing contact current.
You may object to a new sub-processor on reasonable data-protection grounds by writing to support@onloupe.com within the 30-day notice period, as described in DPA Clause 6.4. If a sub-processor must be replaced urgently to protect the security or continuity of the Service, we may make the replacement immediately and will notify you promptly afterwards (DPA Clause 6.5).
Upcoming changes
There are no upcoming sub-processor changes.
Questions
If you have any questions about our sub-processors, please email support@onloupe.com.