Subprocessors
We host our platform primarily within the EU/EEA, apply encryption at rest, and work only with carefully vetted sub-processors that meet rigorous security standards. The table below lists these providers, their processing locations, and the purpose of their services. Where data may be accessed from outside the EEA, we rely on the EU Standard Contractual Clauses and perform transfer impact assessments. We review our sub-processor list regularly and keep this page up to date.
Sub-processor (subcontractor) | Country of processing | Purpose of data processing / description of services | Legal basis for data transfer |
|---|---|---|---|
T-Systems International GmbH (Open Telekom Cloud) | Germany (Magdeburg; Bördeland/Biere) | Cloud platform (PaaS): virtual machines & databases; data encrypted at rest; provider visibility stops at OSI Layer 4 | No third-country transfer (processing within EU/EEA) |
Microsoft Ireland Operations Ltd. (Microsoft Azure) | Germany (Germany West Central region) | Cloud platform (PaaS): virtual machines & databases; data encrypted at rest (Azure KMS); provider visibility stops at OSI Layer 4 | No third-country transfer (processing within EU/EEA) |
Hetzner Online GmbH | Germany (Falkenstein; Nuremberg) | Cloud platform (PaaS): virtual machines & databases; provider visibility stops at OSI Layer 4 | No third-country transfer (processing within EU/EEA) |
Atlassian Corporation (Support Desk / Jira Service Management) | EU (Ireland, Germany), Singapore, United States (N. Virginia, N. California, Oregon) | Support desk for ticket handling: email/username/IP and ticket content | International transfers based on EU Standard Contractual Clauses (via Atlassian DPA); TIA available |
Zoho Corporation GmbH (Site24x7) | Netherlands (Amsterdam); Ireland (Dublin) | Monitoring of server operations: log files that may include IP addresses and usernames; no access to application data | No third-country transfer (processing within EU/EEA) |