Change notifications
We notify merchants of additions and replacements of sub-processors at least fourteen (14) days in advance through this page. Subscribe to the RSS feed (planned) or check this page periodically. Objections may be raised under the procedure described in the DPA.
Payment & settlement
| Sub-processor | Purpose | Location |
|---|
| Stripe Payments Europe Ltd. | Card acquiring, 3-D Secure, fraud screening (multiple Stripe accounts for Payments, Onramply, Registryo, Registryo Hosting). | Ireland / United States |
| Cryptomus Ltd. | Cryptoasset payment acceptance, settlement, and on-ramp partner-of-record. | Canada / Lithuania |
| Wise Payments Ltd. | Fiat payouts and cross-border transfers to merchant bank accounts. | United Kingdom / Belgium |
| VenPayr | Alternative card-to-fiat acquiring for VP-application merchants. | European Economic Area |
| SellAuth / Shopify | Order-flow integration where the merchant uses the named e-commerce platform. | United States / Canada |
Card issuing
| Sub-processor | Purpose | Location |
|---|
| Relograde | BIN sponsor and processor for virtual cards issued through the /visamastercard flow. | European Economic Area |
| Cryptomus (Card Programme) | Card-load and balance-management services for the virtual-card programme. | Canada / Lithuania |
Hosting & infrastructure
| Sub-processor | Purpose | Location |
|---|
| Cloudflare, Inc. | CDN, DDoS protection, WAF, Turnstile bot mitigation, custom-domain checkout Worker. | Global |
| MaxMind, Inc. | GeoIP databases (GeoLite2 Country / City / ASN) used for fraud screening and sanctions. | United States |
| Primary hosting provider | Bare-metal and virtualised compute, database storage, encrypted backups. | United Kingdom / European Economic Area |
Communications & messaging
| Sub-processor | Purpose | Location |
|---|
| Mailgun Technologies, Inc. | Transactional and marketing email delivery; bounce and engagement analytics. | United States / European Economic Area |
| Discord Inc. | Optional Discord-account linking for merchants who opt in to community features. | United States |
| Telegram FZ-LLC | Optional support channel and admin notifications. | Various |
Compliance & risk
| Sub-processor | Purpose | Location |
|---|
| Sanctions list providers (OFSI, OFAC, EU, UN) | Source of consolidated sanctions data ingested daily by import-sanctions.php. | Public sector |
| VASP directory / Travel Rule provider | Counterparty due diligence and Travel Rule message exchange. | European Economic Area |
| KYC / KYB identity provider | Government-ID verification, liveness checks, beneficial-owner screening. | United Kingdom / European Economic Area |
Support tooling
| Sub-processor | Purpose | Location |
|---|
| Internal ticketing (self-hosted) | Merchant and end-user support tickets — data remains within Malum infrastructure. | United Kingdom |
Questions about this list, or to raise an objection to a sub-processor change, write to [email protected].
Last modified 05/12/2026
