Sub-Processor List
Sub-processors used to process personal data on behalf of customers.
| Name | Purpose | Location | Transfer mechanism | Added on |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN and edge network — website and web-app delivery, edge compute, DDoS protection | USA (DPF certified) + EU edge | EU-US Data Privacy Framework + SCCs (fallback) | 2026-03-18 |
| Google Cloud France SARL | Cloud hosting — application servers, database and backups of the Black Cat platform | Belgium (EU) — region europe-west1 | EU entity, data stored in the EU — SCCs in Google's Cloud Data Processing Addendum for any onward transfer | 2026-10-12 |
| Stripe Payments Europe Ltd. | Payment processing — subscription billing via Stripe-hosted checkout and portal (billing contact, payment card, transaction history) | Ireland (EU) | EU entity — no third-country transfer; SCCs for any onward transfer to the United States | 2026-07-22 |
| Olinda SAS (Qonto) | Invoicing and business banking — legal invoice issuance via certified e-invoicing platform (billing contact and invoice data). ACPR-licensed payment institution n°16958, RCS Paris 819 489 626 | France (EU) | EU entity — no third-country transfer | 2026-07-22 |
| Functional Software, Inc. (Sentry) | Error monitoring and performance telemetry | USA (DPF certified) | EU-US Data Privacy Framework + SCCs (fallback) | 2026-04-18 |
| AC PM, LLC (Postmark) | Transactional email — account verification, password reset, alert and report emails (recipient address, message content) | USA | SCCs (Postmark Data Processing Addendum) | 2026-10-12 |
Per DPA §5, we notify customers of any changes with at least 30 days advance notice.