When using our products or services, certain features may rely on centralised or Shared Services provided by specialised teams within the Sage Group. These internal services, known as Core Services, are designed to support the delivery, security, and performance of our software and may involve the processing of personal data by different Sage entities located in various regions.

Please note that while the sub-processors listed on this page are primarily engaged by Sage to process personal data on behalf of its customers (i.e., as processors), some of these entities may also provide services to Sage in other contexts, including where Sage acts as an independent data controller.

• In such cases, the processing activities may relate to Sage’s own business operations - for example, internal analytics, communication tools, or customer relationship management - and are not performed on behalf of customers or in connection with the services we provide to them.
• For more information about how Sage processes personal data in its role as a controller, including the purposes and legal bases for such processing, please refer to our privacy notice.

In particular, if your use of the product or service includes any of the following Core Services, your data may be accessed or processed by dedicated teams within the Sage Group:

Sage Platform services, including interconnectivity features or services that facilitate data exchange between platforms; among them:

1. Banking Service: Automation of the bank reconciliation process. Hosted in AWS, in two regions: EU (Dublin, Ireland) and US (North Virginia, USA). Data is stored in one of these data centres depending on where your bank is located.
2. Compliance: Capabilities to addresses all relevant compliance reporting requirements such as e-invoicing, Regulatory reporting, Tax validation and remitting to local Authorities, ID validation and document signing. Data is hosted by AWS in Frankfurt/Sydney. Only Australia customer data is kept in Sydney, the rest of -Compliance Service is in Frankfurt.
3. Payments Acceptance/Out: Solution to accept and receive payments, adding a ‘Pay Now’ button to sales invoices and customers to make supplier and salary payments within their Sage product. We integrate the most known Payment’s providers, such as GoCardless, Stripe, Paypal, IfThenPay.
   • Payments In data is hosted by AWS in EU (Dublin) and US (North Virginia) for US customer data.
   • Payments Out Data is hosted by AWS in EU (Dublin) and data goes into Modulr, AWS and Cloudflare.
4. Sage ID: Service that lets users establish their digital identity and authenticate in our products. Auth0-Okta provides identity and access management services.
5. Sage Verify: Authenticator app which acts as an additional security layer to let users establish their identity before accessing Sage products and services. Sage Verify uses the following processors: Auth0-Okta for identity and access management services, Crashlytics - for tracking crashes, Google Analytics – for website analytics, and Phrase – for translating content.
6. AP automation: Capabilities to receive, process, pay, and reconcile a supplier or vendor bill inside the product. If you are a French customer we use Veryfi for OCR capability.

Cloud infrastructure and hosting services, which ensure high availability, scalability, and data resilience;

Cyber defence and managed security services, designed to monitor, detect, and respond to cybersecurity threats in real time.

These teams operate under a Shared Service model to provide consistent quality and security across all Sage platforms globally. While the processing of personal data may occur across multiple jurisdictions as part of these operations, all such processing is governed by the same strict technical, organisational, and contractual safeguards, in accordance with applicable data protection laws including the General Data Protection Regulation (GDPR).

• Sage engages the Sage Affiliates listed below to perform activities related to our Core products, Cyber Defence and Service Maintenance. These affiliates may operate under the same corporate structure but in different regions, leveraging shared resources, infrastructure, and expert services to process data on behalf of Sage.
• Sage Group has implemented appropriate intra-group agreements, data transfer mechanisms (such as Standard Contractual Clauses), and access controls to ensure that any cross-border data transfers or internal processing activities are secure, transparent, and legally compliant.

Read the full list of Sage Affiliates.

Sage offers additional services and functionalities created by independent developers (tech partners). If you have contracted any functionality with these third parties, they may act as sub-processors of your data. See the list of Tech Partners available for each region:

France: https://fr-marketplace.sage.com/fr-fr/home
Germany: https://portal.sage.de/appcenter/frontend/
Portugal: https://pt-marketplace.sage.com/
Spain: https://marketplacepartners.sage.com/
United Kingdom: https://uk-marketplace.sage.com/en-gb/home
United States: https://us-marketplace.sage.com/en-us/home

This page is regularly updated to reflect changes in sub-processors list. Download previous versions below:

• Sage sub-processors list: June 2025 to June 2026
• Sage sub-processors list: pre-June 2025

If the European DORA Regulation applies to you and you require further information about our sub-contractors in order to fulfil your obligations, please contact us at the following address: [email protected].

For any questions relating to data processing and agreements with sub-processors, please contact the Data Protection Officer.