These companies process personal data for us. They are our sub-processors. We use each one to provide Sapita, and each one is bound by a written contract with data protection obligations.
| Sub-processor | What it does for Sapita | Where data is processed |
|---|---|---|
| UpCloud | Hosting of the Sapita cluster and its block storage, including the database | Madrid, Spain (EU) |
| Cloudflare | Network and edge security, access control for the admin site, bot checks on sign-in and sign-up, routing of inbound invoice e-mail, and storage of documents and backups | Cloudflare's network. Documents and backups are stored in the EU |
| Cloudflare Email Service | Sending transactional e-mail, such as verification and reminders | Cloudflare's network |
| Stripe | Payments, subscription billing and the invoices for subscriptions | Stripe's systems, with transfers outside the EEA covered as the privacy notice describes |
| Google Firebase Cloud Messaging | Push notifications to the Sapita mobile app, for users who turn them on | Google's systems, with transfers outside the EEA covered as the privacy notice describes |
The Stripe contracting company
The Stripe company that contracts with you will be named in this list once counsel has confirmed it.
What is not listed
Components that Sapita runs on its own infrastructure, such as the analytics on the public website, do not send data to a third party, so they are not listed here.
Changes to this list
We tell you before we add or replace a sub-processor, as the data processing agreement describes, and we update this list when the change takes effect.