Sub- processors

We take a careful, minimalist approach to selecting third-party partners:

• European Focus: All partners are based in Europe for GDPR compliance
• Essential Services Only: We only use partners for core infrastructure needs
• Data Protection Agreements: All partners sign comprehensive DPAs
• Regular Review: We regularly assess and audit our partnerships
• Transparent List: Complete transparency about who processes your data

Our current list of sub-processors and their roles in delivering Workload:

3.1 Data Processing Agreements

All sub-processors are required to sign comprehensive Data Processing Agreements (DPAs) that include:

• Processing Instructions: Clear instructions on how personal data may be processed
• Data Security: Technical and organizational measures to protect data
• Data Subject Rights: Support for exercising individual rights under GDPR
• Incident Notification: Immediate notification of any security incidents
• Audit Rights: Right to audit and inspect data processing activities

3.2 Security Standards

We require all sub-processors to meet stringent security standards:

• Encryption: Data encrypted in transit and at rest
• Access Controls: Strict access controls and authentication
• Monitoring: 24/7 security monitoring and incident response
• Compliance: GDPR compliance and relevant certifications
• Regular Audits: Regular security audits and assessments

3.3 European Data Residency

All our sub-processors operate within the European Economic Area:

• Germany: Hetzner (hosting), AWS SES (email), GatewayAPI (SMS)
• Netherlands: Backblaze B2 (backup storage)
• No Third-Country Transfers: All data processing remains within EU/EEA
• GDPR Protection: Full GDPR protection without additional transfer safeguards

4.1 Adding New Sub-processors

If we need to add new sub-processors, we will:

• 30-Day Notice: Provide at least 30 days advance notice
• Update This Page: Update this page with new information
• Email Notification: Send email notifications to all customers
• Due Diligence: Conduct thorough security and privacy assessments

4.2 Customer Objections

If you object to a new sub-processor, you may:

• Contact Us: Discuss your concerns within 30 days of notification
• Request Alternatives: We'll work to find suitable alternatives
• Data Export: Export your data if no acceptable solution exists

4.3 Removing Sub-processors

If we discontinue using a sub-processor:

• Secure Data Return: Ensure secure return or deletion of all data
• Update Documentation: Update this page and notify customers
• Audit Completion: Verify complete data removal

You have the right to know how your data is processed by our sub-processors:

• Transparency: This page provides complete transparency about data processing
• Access Requests: Request information about how sub-processors handle your data
• Data Portability: Export your data from any of our systems
• Deletion Requests: Request deletion of your data from all systems
• Processing Restrictions: Request limitations on data processing