Subprocessors

F&D Ventures LLC, doing business as Tormano (“Tormano”), engages the third-party subprocessors listed below to deliver the Tormano CRM service. This list is maintained in accordance with Article 28 of the GDPR and the corresponding provisions in our Data Processing Agreement and Privacy Policy.

Notification of changes

Before we engage a new subprocessor to process Customer Personal Data, we email you at least 30 days before it begins processing, naming the specific subprocessor being added. That email goes to your account Owner’s address and to every address on the notification list. At the same time we publish the change in the table below, revise the “Last Updated” date, and add a dated entry to the change history at the end of this page, so you can confirm what changed and when. We do not treat publishing this page as a substitute for telling you, and you do not have to watch this page to be notified. To add an address to the notification list, or remove one, email privacy@tormano.com with the subject line “Subprocessor Notifications”. If your organization has accepted our Data Processing Agreement, Section 6.3 of it gives you 30 days from that notice to object, and sets out what happens if we cannot accommodate your objection.

Current subprocessors

The following subprocessors are currently engaged. We select them on the security and privacy posture each one publishes, and we engage each of them under the standard terms that provider publishes and that we accepted when we opened our account.

The Compliance column lists the certifications and audit reports each provider publishes about itself. They are each provider’s own published claim, not a statement that Tormano has verified it, and that is true of every row. Where the column reads “None identified” we have not identified a published certification for that provider, and the relationship is governed by your own organization’s agreement with it. We have not negotiated or executed a separate, signed data processing agreement with any subprocessor on this list, and we have not obtained or reviewed a copy of any subprocessor’s audit report. Several of these providers incorporate data processing terms into the standard online terms we accepted, which would make those terms binding on them by acceptance rather than by signature, but we have not established that provider by provider. Closing this gap is an open item.

If you need the data processing terms for a particular subprocessor, for your own record, an audit, or a security review, email privacy@tormano.com naming the provider. We will tell you precisely what is in place for that provider today, send you what we hold, and where terms are not yet in place we will say so and pursue them with that provider. Our own commitments to you about how we handle your data are in our Data Processing Agreement, and under Section 6.5 of it we remain fully liable to you for a subprocessor’s failure to meet its data protection obligations.

Notes on particular providers

• Hetzner Cloud. Hetzner’s ISO 27001 certificate scope names its Nuremberg, Falkenstein and Helsinki sites and does not cover Ashburn, which is where customer data is held. Hetzner does not publish a SOC 2 report.
• Stripe. Stripe is engaged when an organization purchases a paid plan or accepts payments through the Service. No data is sent to Stripe at signup or during a free trial. Where an organization connects its own Stripe account, that organization is the merchant of record for the donations and payments it accepts, and Stripe acts as that organization’s own payment processor under its agreement with Stripe.
• Hunter.io. It is the one enrichment provider that receives more than an email address. It receives a contact’s email address, to check whether that address is deliverable, and separately a company’s web domain, to look that company up. It is also the only one engaged for company records, where a domain is sent and no email address is.
• Double the Donation. For each online gift it registers, it receives the donor’s first and last name, email address, telephone number and full mailing address, together with the gift amount, date, campaign name, payment identifier, and the employer the donor selected or typed into the employer-lookup field on the donation form. Gifts marked anonymous are never registered.

Public bodies and services that receive no personal data

The services below are used by Tormano but are not subprocessors: they are either public bodies publishing open data, or services that receive no Customer Personal Data at all. There is no data processing agreement behind a public-records API, so they are named here rather than left out.

• ProPublica Nonprofit Explorer. Optional research lookups on nonprofit organizations, used only when your organization enables them. A lookup transmits only the search terms needed for the query, such as an organization name; results come from Form 990 records ProPublica already publishes.
• U.S. Census Bureau. A U.S. federal agency, not a contracted processor. Two lookups reach it. Where your organization looks up external data for a contact or company, the Service resolves the record’s postal address to coordinates through Mapbox and then sends only that latitude and longitude to the Census geocoder to obtain the census tract; no name, address, postcode or record identifier is sent with it. It then requests area demographics for that tract, which carries no personal data at all. We list this because a coordinate resolved from someone’s address is still information about where that person is, even though nothing identifying them accompanies it.
• UptimeRobot. External availability checks of our public endpoints; receives no Customer Personal Data.
• Healthchecks.io. Confirms that scheduled jobs and backups ran; receives only the name of a job and the time it ran, and no Customer Personal Data.

Customer-initiated integrations

Some integrations are activated only when a customer connects their own account: Intuit QuickBooks, Xero, Google Workspace, Google Sheets, Microsoft 365, Microsoft Teams, Slack, Mailchimp, Constant Contact, Eventbrite, Calendly, Zoom, Zapier, Double the Donation, and the WhatsApp Business Platform. Tormano does not receive or process data from these services unless and until the customer initiates the integration, and each is additionally governed by that provider’s own privacy policy and terms of service. Every one of them is listed in the table above, because once connected each receives personal data from Tormano, and the objection right in Section 6.3 of our Data Processing Agreement applies to every provider on this page.

Data residency

Tormano’s production data store and application servers are hosted in a Hetzner Cloud data center in the United States (Ashburn, Virginia). All customer data at rest is in the United States, and no customer data is stored in Hetzner’s European data centers. The processing location shown for each subprocessor in the table above is that provider’s stated location, where we have established one. Every location we have established is in the United States, apart from Xero’s, which is stated as New Zealand and the United States. Three rows, the optional enrichment providers Hunter.io, Apollo.io and Lusha, read “Not established”: we have not obtained a stated processing location from those providers, and we will not print a location we have not been given into a column that Section 6.6 of the Data Processing Agreement makes contractually authoritative. None of the three receives anything unless your organization connects that provider’s own API key, and we will replace those entries with a location as soon as we have one from the provider. If you are in the EEA, the UK or Switzerland, your personal data is therefore transferred to the United States as a matter of course rather than exceptionally, and we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum and the Swiss adaptation of those Clauses, together with supplementary technical and organizational measures. We do not rely on the EU-U.S., UK Extension or Swiss-U.S. Data Privacy Framework. Section 10 of the Data Processing Agreement sets out the mechanisms in full.

Change history

Each change to the table above is recorded here on the date it was published. Section 6.1 of our Data Processing Agreement makes this page contractually authoritative; this log is the part of it that shows you what changed.

This log begins on August 24, 2026. Earlier changes to this page were published by revising the “Last Updated” date alone and were not itemized at the time.

Contact

For questions about this list, including subprocessor change notifications, contact privacy@tormano.com.

F&D Ventures LLC
8401 Mayland Drive #5368, Richmond, VA 23294, USA
Privacy: privacy@tormano.com
Legal: legal@tormano.com
Support: support@tormano.com