Sub-processors
Last Updated: August 25, 2026
This page lists the third-party sub-processors engaged by SJW Group, Inc., a New York corporation, d/b/a More Good Reviews ("MGR", "we", "us", or "our") to process personal data on behalf of our business customers when we act as a data processor under our Data Processing Agreement.
This list is incorporated into and forms part of our DPA. We update this page when we add or replace sub-processors.
1. What Is a Sub-processor?
A sub-processor is a third party that processes personal data on our behalf to help us deliver the Services. We enter into written agreements with each sub-processor requiring data protection obligations substantially equivalent to those in our DPA.
When you use MGR to process personal information about your end customers, contacts, or other individuals, the sub-processors below may process that data according to your instructions and our DPA.
For how we process personal information in our role as a data controller (for example, your MGR account and billing information), see our Privacy Policy.
2. Current Sub-processors
| Sub-processor | Processing purpose | Location | Privacy policy |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure including compute, S3 object storage, RDS relational database, SQS queues, and SES transactional email | United States | aws.amazon.com/privacy |
| Bright Data Ltd. | Public review data collection from third-party review sites for import into your project | Israel / United States | brightdata.com/privacy |
| Browserless.io Inc. | Headless browser automation used by certain platform-side tasks | United States | browserless.io/privacy |
| Cloudflare, Inc. | DNS, edge caching, CDN, WAF, bot mitigation (Turnstile), and custom domain management | United States | cloudflare.com/privacypolicy |
| Functional Software, Inc. (Sentry) | Application error monitoring and performance telemetry, which may incidentally include personal data captured in stack traces or breadcrumbs | United States | sentry.io/privacy |
| Google LLC | Maps and Places APIs, OAuth sign-in, and Google My Business API used to import and reply to Google reviews | United States | policies.google.com/privacy |
| Mailgun Technologies, Inc. | Transactional and review request email delivery, including reminders and bounce/unsubscribe handling | United States | mailgun.com/legal/privacy-policy |
| OpenAI, L.L.C. | AI-generated review suggestions, highlights, replies, and auto-tagging based on review and customer content | United States | openai.com/policies/privacy-policy |
| PostHog, Inc. | Product analytics and usage measurement for the Services, which may include metadata about actions performed on customer data | United States | posthog.com/privacy |
| Postman, Inc. | API development, documentation, and monitoring tooling used in operating the Services | United States | postman.com/trust/privacy |
| Stripe, Inc. | Subscription billing, payment processing, and invoice management for your account | United States | stripe.com/privacy |
| Twilio Inc. | SMS delivery for review request messages and reminders, including delivery status and STOP handling | United States | twilio.com/en-us/legal/privacy |
3. Services You Connect Directly
The following are not MGR sub-processors. If you connect or authorize these services through the Services, they process data under your relationship with that provider:
- HubSpot
- Slack
- Discord
- ClickSend
- SimpleTexting
- TextLink
- Your own SMTP or Twilio account
- Other third-party integrations you initiate and control
You are responsible for reviewing those providers' terms and privacy practices.
4. How We Manage Sub-processors
Before engaging a sub-processor that processes personal data on behalf of our customers, we evaluate the provider's security and data protection practices and contractually require appropriate confidentiality, security, and purpose-limitation obligations.
We remain responsible for each sub-processor's performance of processing activities to the same extent as if we performed those activities ourselves.
5. Changes to This List
We may add or replace sub-processors as the Services evolve. When we do, we will:
- update this page;
- provide at least thirty (30) days' notice to affected business customers by email to the primary account contact and by in-product notice; and
- honor objection rights described in Section 6 of our DPA.
We encourage business customers to bookmark this page or subscribe to product updates if they need to monitor sub-processor changes for their compliance programs.
6. Objecting to a New Sub-processor
If you are a business customer and wish to object to a new sub-processor on reasonable data protection grounds, email legal@moregoodreviews.com within fifteen (15) days of receiving notice of the change.
We will work with you in good faith to resolve the objection. If we cannot reach a resolution, you may terminate the affected Services without penalty as described in our Data Processing Agreement.
7. Contact Us
Questions about this list or our sub-processors may be sent to:
SJW Group, Inc., a New York corporation, d/b/a More Good Reviews
Email: legal@moregoodreviews.com
Address: 525 E 14th St 7H, New York, NY 10009, United States