Sub-processors
We use sub-processors for parts of our service. This page shows who they are, what they do for us and where they process data. With every party we have a data processing agreement with obligations at least equivalent to our own data processing agreement; for parties outside the EEA a valid legal framework applies, such as the EU-US Data Privacy Framework or the Standard Contractual Clauses.
When we add or replace a sub-processor, we email the administrators of your account at least 30 days in advance. If we have to replace a sub-processor urgently because it fails or suffers a security incident, we do so immediately and notify you within 5 working days; your 30-day objection period then starts at that notification.
Every party is on this list because somewhere in the chain it touches personal data we process on behalf of your organisation. Each row says which. Parties that work only for our own operations, such as our payment provider, are covered by the privacy policy.
Overview
| Sub-processor | Function and data | Processing location | Transfer outside the EEA | Certification |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting, database, file storage and backups: account data, audit logs, files, support history | Germany, backups Finland | ISO 27001C5 | |
| Cloudflare | Network layer around the platform (DDoS protection, encryption, bot detection) and storage of support conversations: all traffic, IP addresses, conversation content and attachments | Storage Western Europe; global network, traffic is normally handled at the nearest location | EU-US Data Privacy Framework | ISO 27001ISO 27701SOC 2 Type IIPCI DSS |
| Postmark (ActiveCampaign) | Email notifications: names, email addresses | US | EU-US Data Privacy Framework | SOC 2 Type II |
| Plain | Support: names, email addresses, conversation content | UK | Adequacy decision | SOC 2 Type II |
| HEY (37signals) | Incoming email for our support addresses: names, email addresses, message content. Forwarded automatically, not stored | US | Standard Contractual Clauses | |
| Linear | Product feedback and work tracking: names, quotes from support messages | EU | ISO 27001SOC 2 Type II | |
| Anthropic Ireland Limited | AI assistance for support and operations: conversation and platform content. Retained at most 30 days, no training | US | Standard Contractual Clauses | ISO 27001ISO 42001SOC 2 Type II |
| Upscope | Screen sharing, only at the user's request and only for the duration of the support session: screen content. Nothing about the user themselves (name, email, IP address, location, device) is recorded | Germany | ISO 27001SOC 2 Type II | |
| DeepL SE | Translation of platform content; texts are processed instantly, not stored and not used for training | AWS regions EU, US and Japan | Standard Contractual Clauses | ISO 27001SOC 2 Type IIC5 |
| AppSignal | Performance and error monitoring: technical telemetry; on an error the account and user ID involved | Netherlands | ISO 27001 |
Last updated: 17 September 2026. Questions about this list? Email team@eclarion.com.