Legal
Sub-processors
Last updated: 20 October 2026
These are the companies that process personal data on our behalf. Section 1 lists the sub-processors for client work: providers that may process a client’s personal data under our data processing agreement. Section 2 lists the providers behind our website, communication and administration. Every provider works under a data processing agreement with us. How and why we use them is explained in our Privacy Policy.
1 Sub-processors for client work
For clients, this list matches Annex III of our data processing agreement. We tell clients at least 30 days before we add or replace a sub-processor, and they can object within 14 days.
| Provider | What for | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database and application backend, including the exclusion list from /data-objection | Frankfurt, Germany (EU) | Stored in the EU; standard contractual clauses for access from outside the EU |
| Hetzner Online GmbH (Germany) | Servers for our analysis engine | Germany (EU) | None needed |
| Cloudflare, Inc. (USA) | File storage (R2, EU jurisdiction) | EU | EU-US Data Privacy Framework; standard contractual clauses |
| Apify Technologies s.r.o. (Czech Republic) | Collecting public posts and comments from TikTok, Instagram and YouTube | USA (Amazon Web Services) | Standard contractual clauses; Amazon Web Services: EU-US Data Privacy Framework |
| Anthropic Ireland, Limited | AI-assisted classification and drafting, and answers from Craig | USA | Standard contractual clauses |
| OpenAI Ireland Ltd | AI-assisted classification and drafting, and answers from Craig | USA and other countries | Standard contractual clauses |
| Google Cloud EMEA Limited (Gemini API) | AI-assisted classification and drafting, and answers from Craig | USA and other countries | EU-US Data Privacy Framework (Google LLC); standard contractual clauses |
| Google Cloud EMEA Limited (Google Workspace) | Email, documents and delivery of reports | EU, with possible transfers to the USA | EU-US Data Privacy Framework (Google LLC); standard contractual clauses |
2 Website, communication and administration
| Provider | What for | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. (USA) | Website hosting, network and form protection (Turnstile) | Worldwide (content delivery network) | EU-US Data Privacy Framework; standard contractual clauses |
| Sendinblue SAS (Brevo, France) | Emails: confirmations, newsletter, double opt-in | EU; some of Brevo’s sub-processors outside the EEA | Standard contractual clauses; EU-US Data Privacy Framework for US recipients |
| Attio Ltd (United Kingdom) | Customer relationship management and consent records | EU (Google Cloud) | UK adequacy decision; standard contractual clauses |
| Cal.com, Inc. (USA) | Booking calls | USA | EU-US Data Privacy Framework; standard contractual clauses as fallback |
| Plausible Insights OÜ (Estonia) | Website analytics without cookies | Germany (EU) | None needed |
| PandaDoc, Inc. (USA) | Contract signing and client onboarding | USA | EU-US Data Privacy Framework; standard contractual clauses |
| Linear Orbit, Inc. (USA) | Internal project and task tracking | USA | Standard contractual clauses |
| sevDesk GmbH (Germany) | Accounting | EU | None needed |
3 Changes to this list
We update this page when we add, replace or drop a provider. Clients are told in advance, directly, as set out in the data processing agreement. Questions about a provider: [email protected].
Other legal pages