Quick Guide: Subprocessors

Background

Subject to the instruction of a Customer, Coupa Software, Inc. ("Coupa") hosts a Customer instance either in the Europe Economic Area, United States of America, in the APAC region or as otherwise agreed. In the course of providing services on the Coupa Platform, Coupa personnel located inside and outside of the selected hosting region may require access to Customer Data.

In addition, Coupa and its Affiliates engage third-party contractors and suppliers in the context of the provision of the Coupa Platform and selected Hosted Applications (“Third-Party Suppliers”). Some of these Third-Party Suppliers may have access to, and process, Customer Data, including Customer Personal Data (“Subprocessors”).

This quick guide shall provide you with an overview on the various Subprocessors currently used by Coupa in the performance of the Coupa services. Please note that the specific details of Subprocessors used for each Customer depend on the individual subscription scope and configuration. This quick guide is subject to change.

Default Subprocessors

If you are a customer on the Coupa platform, the following Third-Party Suppliers are used as default Subprocessors.

Additional Subprocessors

Depending on the individual subscription scope and configuration of a Customer on the Coupa platform, the following Third-Party Suppliers are used as additional Subprocessors by Coupa when providing the services.

 ^{[i] For more details see https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/.
 [ii] For more details seehttps://aws.amazon.com/ses/.
 [iii] Google uses distributed global data centers to temporarily process image files and return back results of the OCR function. Google currently does not offer regionalization of processing within  Google Cloud Vision API. For more details see https://cloud.google.com/vision/docs/data-usage.
 [iv] Google Translation, Google Maps, Google Places and Google Analytics may in their terms of use, seek to use customer personal data from time to time; however Coupa does not share such personal data with Google. Coupa utilizes Google Maps for certain products which require location-based services. Google requires that the following terms are notified to customers as part of Coupa’s obligations in its use of Google Maps: (1) Google Maps/Google Earth Additional Terms of Service: https://maps.google.com/help/terms_maps.html; and (2) Google Privacy Policy https://www.google.com/policies/privacy/. 
 [v] Mastercard International Incorporated is expected to be offered to customers from later in Q1 of 2024.}

Legacy Subprocessors & Subcontractors

If you are a Customer on a legacy platform of a company previously acquired by Coupa, the following legacy subcontractors are currently used. Depending on the configuration, some of the legacy subcontractors may have access to Customer Personal Data and thus qualify as a Subprocessor. Other subcontractors are listed for information only.

_{Legal Disclaimer - This website is provided for informational purposes only and should not be considered as legal advice and does not discuss other privacy-related laws or regulations that may also be relevant to our customers and prospects, including any industry-specific requirements. The relevant privacy and data protection laws and regulations applicable to individual companies will depend on several factors, including but not limited to where a company conducts its business, the industry in which it operates, the type of content it wishes to store, where or from whom the content originates, and where the content will be stored.}