Sub-processors
Last updated: 29 October 2026. Matches Annex C of the Data Processing Agreement, version 1.1.
These are the providers Enalitica engages to process personal data on behalf of its customers. The binding list is Annex C of our Data Processing Agreement; this page shows the same list so it can be checked and linked without opening the whole agreement.
| Sub-processor | Service | Processing location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Germany, Finland (EU) | No third-country transfer |
| Cloudflare, Inc. | DNS, proxy, attack protection (data in transit only) | EU points of presence | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | USA | Standard Contractual Clauses |
| Anthropic, PBC | AI report generation (aggregated data), only where the module is enabled | USA | Standard Contractual Clauses |
| OpenAI, L.L.C. | AI report generation (aggregated data), only where the module is enabled | USA | Standard Contractual Clauses |
| Google Ireland Ltd | AI report generation and document processing, only where the module is enabled | EU, USA | Standard Contractual Clauses |
Anthropic, OpenAI and Google are used only where the customer has enabled the corresponding module, and only aggregated data containing no personal data are transmitted to them. Where an AI module is enabled, only a paid provider account on which submitted data are not used for model training may be used.
Services you connect yourself
Services you connect with your own accounts (Google, Meta, LinkedIn, Mailchimp, payment and delivery providers, as set out in Section 6.4 of the DPA) are not our sub-processors. They process data under your own agreement with each provider.
Changes to this list
We inform customers of any intended replacement or addition of a sub-processor at least 30 days in advance, by email. A customer may object on reasonable data-protection grounds, as described in Section 6.2 of the DPA.
Questions: [email protected]. See also Security and trust and the Privacy Policy.