Sub-processors
Draft: 23 October 2026.
Template – to be reviewed by a lawyer before launch. This text is a draft for Stafeta's launch; the double-bracketed parts wait to be filled in, the rest waits for legal review. Not legal advice.
The list
This list is the annex to section 4 of the data processing agreement. Customers are e-mailed about changes with the notice period given there.
| Sub-processor | What it does | Where it processes | Transfer outside the EU |
|---|---|---|---|
| Supabase, Inc. | database, authentication, file storage, backups | EU – Frankfurt (AWS eu-central-1) | none; support access from the USA under SCCs |
| Vercel, Inc. | web hosting, server-side functions | EU – Vercel region to be set, e.g. fra1 | US company: DPF / SCCs |
| Anthropic, PBC | AI model (Claude API): drafts, proposals, triage | USA | DPF / SCCs; no training on API data; retention: term checked at signing |
| Stripe Payments Europe, Ltd. | subscriptions, payments, invoices, VAT calculation | EU – Ireland | Stripe, Inc. (USA) under DPF / SCCs |
| Cloudflare, Inc. | Turnstile bot protection on public forms and sign-in | EU network; a global provider | DPF / SCCs |
| Plausible Insights OÜ | website statistics (only after consent, cookieless) | EU – Estonia; servers in Germany | none |
| SMTP-szolgáltató | transactional e-mail: sign-in links, notifications | EU | none |
Not a sub-processor but the customer's own tool, connected with the customer's own account and used on its own instruction: Mailchimp, Google Workspace (Drive, Docs, Gmail send), Microsoft 365 (mail send), the company's WordPress site, the WhatsApp provider. We ask these for the narrowest right only (for example send only, or only the files Stafeta created).