Legal
Subprocessors
The sub-processors cargo protection uses to provide the platform: Annex 2 of the data processing agreement.
Current sub-processors
As listed in Annex 2 of our data processing agreement, with the place of processing and the basis for any transfer outside the EEA.
| Company | Service | Place of processing | Basis for third-country transfer |
|---|---|---|---|
| Railway Corporation, San Francisco, USA | Hosting of the platform | EU, Amsterdam region | EU-US Data Privacy Framework or standard contractual clauses under the DPA |
| Supabase Pte. Ltd., Singapore | Database, authentication, file storage | EU | Standard contractual clauses under the DPA |
| Google Cloud EMEA Ltd., Dublin, Ireland | Document extraction (Document AI) | EU | Standard contractual clauses under the Cloud Data Processing Addendum |
| OpenAI Ireland Ltd., Dublin, Ireland | Extraction and structuring of email and document content | EU (European data residency) | EU-US Data Privacy Framework or standard contractual clauses under the DPA |
| Twilio Ireland Ltd., Dublin, Ireland | Telephone number verification (Lookup) | USA | Binding corporate rules (BCR) |
| Bouncer Sp. z o.o., Wrocław, Poland | Email address verification | EU (Frankfurt am Main) | No transfer |
| Plus Five Five, Inc. (Resend), San Francisco, USA | Sending of system emails | EU | EU-US Data Privacy Framework, standard contractual clauses |
| widdix GmbH (attachmentAV), Germany | Malware scanning of uploaded files without storage | EU | No transfer |
| Cloudflare, Inc., San Francisco, USA | Delivery and protection of the website (content delivery network) | EU and worldwide | EU-US Data Privacy Framework, standard contractual clauses |
| Microsoft Ireland Operations Ltd., Dublin, Ireland | Email communication (Microsoft 365) | EU/EEA | EU Data Boundary; standard contractual clauses under the Microsoft DPA |
The payment service provider is not listed: it processes only the Client’s invoicing and payment data under its own responsibility and no query data. VAT number verification via VIES and domain queries likewise do not constitute sub-processing within the meaning of § 5.4.
Changes
We inform customers by email at least 14 days before we engage or replace a sub-processor. Customers may object within this period for an important reason relating to data protection (DPA § 5.2).
Questions about a named provider: write to us.
Send an enquiryData processing agreementPrivacy policy