Companies / Capptions / Subprocessors
Capptions provides a safety management system that connects policy, procedure and action for Seveso and ARIE companies. It serves HSE managers and safety specialists at these companies.
Summarized from its homepage on 7 Nov 2026.
Rotterdam, NL
Subprocessors of Capptions
Capptions declares 9 subprocessors.
| Subprocessor | Purpose |
|---|---|
| Object storage for uploaded media and documents (S3), transactional email (SES), notifications (SNS), CDN (CloudFront, serving cdn.capptions.com and download.capptions.com), and the container image registry (ECR). Not primary application hosting. | |
| Log management, uptime monitoring, incident management / on-call, and error tracking. Receives application and infrastructure logs shipped from the whole Kubernetes cluster, plus application error reports. | |
| DNS, CDN, DDoS protection, WAF | |
| Internal email, calendars, documents — incidental Customer Data only in support tickets | |
| Primary application hosting — Kubernetes (k3s) cluster of 6 nodes, primary application databases (MongoDB replica set, Redis, OpenSearch) and object storage for Kubernetes persistent volumes | |
| CRM, marketing automation, email | |
| Engineering issue tracking — incidental Customer Data only in support tickets | |
| Error monitoring (scrubbed of PII at SDK level) for the Go-based media and audit services, and the legacy white-label mobile apps and legacy web client only. The main API, the web router and the Capptions Direct mobile app report errors to Better Stack instead. | |
| Payment processing for the Direct Marketplace and subscriptions |
Certifications
| Standard | What the source says | Checked |
|---|---|---|
| ISO 27001Company's statement | “Capptions is ISO 27001 and SOC 2 Type II certified.”The company's own statement. We have not checked an accreditation registry. | 13 Nov 2026Source |
| SOC 2 Type IICompany's statement | “Capptions is ISO 27001 and SOC 2 Type II certified.”The company's own statement. SOC 2 has no public registry; the report itself is shared by the company, usually under NDA. | 13 Nov 2026Source |
We last read its homepage on 13 Nov 2026 and the FedRAMP Marketplace on 8 Nov 2026. A standard not shown here was not found in these sources. That does not mean Capptions lacks it.
Vendor's own statement, retrieved from the source URL on the date shown. StrataDB does not verify the underlying claim. Data sources.
See Capptions's full stack
Every vendor with its source and date, and an alert when Capptions adds or drops one. The same lookup works for any company.
- Every company and vendor, with its public source
- 100 API calls a month, plus MCP and the Chrome extension
- Work email only. No card, no sales call