1. Current sub-processors
| Sub-processor | Legal entity | Purpose | Data category | Region | Transfer mechanism |
|---|---|---|---|---|---|
| Microsoft Azure | Microsoft Ireland Operations Limited | Application hosting, Azure SQL, identity (Entra ID), storage | Customer Data, Account Data, Telemetry | EU (Ireland) — primary · UK / US for Premium residency requests | EU SCCs / UK IDTA · EU-US Data Privacy Framework |
| Stripe | Stripe Payments Europe Ltd · Stripe, Inc. | Subscription billing, payments, customer portal | Account Data (name, billing address, payment method) | Ireland · United States | EU SCCs / UK IDTA · EU-US DPF |
| Anthropic | Anthropic, PBC | Claude model inference for the AI Assistant | AI prompts and completions (Customer Data sent only when a user invokes the Assistant) | United States | EU SCCs · zero-retention API tier · no model training on customer data |
| Postmark | Wildbit, LLC (an ActiveCampaign company) | Transactional email (invitations, magic-links, receipts) | Account Data (email address, name) | United States | EU SCCs · EU-US DPF |
| Cloudflare | Cloudflare, Inc. (EU: Cloudflare Germany GmbH) | CDN, DDoS protection, DNS, WAF | Technical Data (IP, request metadata) | Global edge | EU SCCs · EU-US DPF |
| Google Workspace | Google Ireland Limited | Sign-in (OAuth) | Account Data (email, name) | Ireland · United States | EU SCCs · EU-US DPF |
| Sentry | Functional Software, Inc. | Error tracking and performance monitoring | Telemetry, error context (scrubbed of Customer Data) | United States · EU (Frankfurt) for EU tenants | EU SCCs · EU-US DPF |
| Plausible | Plausible Insights OÜ | Privacy-first product analytics | Aggregated usage (no cookies, no IPs stored) | European Union (Germany) | Intra-EU — no transfer mechanism required |
2. About the data categories
- Customer Data — the records you and your Users submit to the Service (engagements, timesheets, invoices, people).
- Account Data — identifying information about Users and Workspace Owners (names, emails, billing address).
- Telemetry — performance, error and security signals tagged with TenantId only, never with personal identifiers.
- AI prompts and completions — only sent to AI sub-processors when a User invokes an AI feature, under the zero-retention and no-training terms described in our AI Notice.
3. How we notify changes
We will send the change notice to the email address of record for every Workspace Owner. The notice will include: the new sub-processor, its country, the data category it will process, the reason for the change, and the date the change takes effect. If Customer reasonably objects on data-protection grounds within 30 days, Customer may terminate the affected subscription without penalty under clause 6 of the DPA.
4. Auxiliary vendors
We also use auxiliary vendors that do not have access to Customer Personal Data (for example: Plausible for marketing-site analytics, documentation hosting, internal tooling). These are not listed as sub-processors because they do not process Customer Personal Data on our behalf inside the meaning of GDPR Article 28.
5. Contact
Questions about sub-processors should be sent to dpo@alsviorglobal.com.