Infrastructure & Hosting
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|
| Hetzner Online GmbH |
Application hosting + PostgreSQL database |
Germany (Falkenstein / Nürnberg) |
All customer data (contacts, message history, workflow runs, audit logs) |
EU residency, encryption at rest, daily encrypted backups (30-day retention), ISO 27001 |
| Cloudflare, Inc. |
DNS, CDN, DDoS protection, WAF, Email Routing |
Global edge / EU regions where available |
All in-transit traffic; email forwarding for *@soqqet.com |
SCCs (EU→US), encryption in transit, no caching of personal data |
Messaging Channels
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|
| Meta Platforms, Inc. (WhatsApp Business API) |
Message delivery via WhatsApp |
EU / US |
Phone numbers, message content, delivery status |
SCCs, Meta Data Processing Terms |
| Twilio, Inc. |
SMS delivery; WhatsApp BSP access |
EU (Ireland) / US |
Phone numbers, message content, delivery status |
SCCs, Twilio DPA |
| Telegram FZ-LLC |
Message delivery via Telegram Bot API |
UAE / global |
Telegram user IDs, message content |
Telegram Bot API Terms |
Payment Processing
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|
| Authorized Merchant of Record (disclosed at checkout once onboarding completes) |
Merchant of Record, payment processing, tax remittance globally, dispute handling |
EU / UK / US (depends on chosen MoR) |
Customer billing info, payment methods, invoice data |
SCCs, PCI DSS, MoR-specific DPA — full details published once MoR is selected |
Communication & Support
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|
| Sendinblue SAS d/b/a Brevo |
Transactional email (account notifications, invoices, system emails) |
France (Paris) |
Customer email addresses, transactional email content |
EU residency, GDPR compliant by design |
Analytics
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|
| Google LLC (Google Analytics 4) (planned, will be enabled after explicit cookie consent) |
Privacy-respecting website analytics |
EU regions / US |
Anonymized usage events; no individual tracking pre-consent |
SCCs, IP anonymization, opt-in via cookie banner |
Notification of Changes
We update this list when sub-processors change. Customers receive 30-day advance notice for new sub-processors via email. To subscribe to sub-processor updates, email [email protected].