1. What This List Is
This is the canonical list of the sub-processors we engage to process personal data on behalf of our customers. It exists as one document, with one version, because the Data Processing Addendum turns it into a commitment: under a general written authorisation we must notify customers before a new sub-processor begins processing, and allow them to object. A commitment whose subject can change without anything noticing is a commitment nobody can keep.
Changing this list requires moving its version, and the version is what the notification fires on. Both are enforced in CI rather than remembered.
2. Notice and Objection
We notify the owner of each workspace whose organisation has accepted the Data Processing Addendum, by email, at least 30 days before a new sub-processor begins processing personal data, and we update this list at the same time.
The obligation follows the contract: it is owed to customers who have accepted the Addendum. Where none has, there is nobody entitled to notice and the period has nothing to run against — which is a consequence of the commitment, not an exception to it.
A customer may object on reasonable data protection grounds by replying to that notice or writing to support@eptk.cloud within the notice period. If the objection cannot be resolved, either party may terminate the affected part of the Service.
3. Sub-processors
- Google Ireland Limited / Google Cloud — hosting, database, file storage, authentication, AI processing, and analytics warehousing. Authentication data is processed in the United States; see section 5.
- Stripe, Inc. — payment processing
- Twilio SendGrid — transactional email delivery: invitations and notifications to users, and the received, approved and rejected messages to accreditation applicants. Twilio's own terms make it an independent controller of that email content, including the recipient's address, for purposes of its own: security and abuse prevention (including developing its internal tools and related model training), business analytics and product development. For those purposes it is not bound as our sub-processor; see section 7 of the Data Processing Addendum.
- PostHog Inc. — product analytics, EU Cloud (Frankfurt)
- Linear Orbit, Inc. — support and feedback requests raised from within the Service or through the public feedback form
- Slack Technologies (Salesforce, Inc.) — support handling
- Vaisala Xweather — weather data for a location
- AirLabs — flight status for a flight number
4. Engaged Only at the Customer's Own Choice
These are engaged only where a customer connects its own account with the provider. The content stored there is held under the customer's own agreement with that provider rather than under our Addendum, and its location follows that arrangement.
- Microsoft Ireland Operations Limited — customer-connected SharePoint or OneDrive storage
- Dropbox International Unlimited Company — customer-connected Dropbox storage
- Google Drive (Google Ireland Limited) — customer-connected Google Drive storage
5. Processing Outside the European Union
Personal data is stored and processed within the European Union, with one exception:
- Authentication data — email address, password hash and sign-in identifiers — is processed in the United States, because the authentication service we use offers no European location. The transfer is made under the European Commission's adequacy decision for the EU–US Data Privacy Framework and under Standard Contractual Clauses, as set out in the provider's data processing terms.
Other sub-processors may process data outside the European Union under equivalent safeguards.
6. Services That Act as Independent Controllers
These services are used by the Service, but under their own terms they are not our sub-processors. They act as independent controllers of the data they receive, under their own privacy policies, and the obligations of our Data Processing Addendum do not reach them. They are listed here so that a customer can tell its own people where their data goes. A change to this section moves the version of this list in the same way as a change to section 3.
- Google Maps Platform (Google Ireland Limited) — map display, place search and detail lookup, turning an address into coordinates, and road routing. Contracted separately from Google Cloud above, under the Google Maps Platform terms, which make Google an independent controller of what it receives through these services. What it receives: the text typed into an address field or given to the assistant to find a place, the coordinates and departure time of a transport being routed, and, when a map is shown, the viewer's IP address. Google's Privacy Policy applies to that data. Google does not state a processing location for these services.
7. Contact
Questions about this list, and objections under section 2, go to support@eptk.cloud.