Soqqet engages the following sub-processors to deliver our services. We notify customers at least 30 days before adding new sub-processors. Customers may object by emailing [email protected].
Last updated: 2026-05-01
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting + PostgreSQL database | Germany (Falkenstein / Nürnberg) | All customer data (contacts, message history, workflow runs, audit logs) | EU residency, encryption at rest, daily encrypted backups (30-day retention), ISO 27001 |
| Cloudflare, Inc. | DNS, CDN, DDoS protection, WAF, Email Routing | Global edge / EU regions where available | All in-transit traffic; email forwarding for *@soqqet.com |
SCCs (EU→US), encryption in transit, no caching of personal data |
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|---|---|---|---|
| Meta Platforms, Inc. (WhatsApp Business API) | Message delivery via WhatsApp | EU / US | Phone numbers, message content, delivery status | SCCs, Meta Data Processing Terms |
| Twilio, Inc. | SMS delivery; WhatsApp BSP access | EU (Ireland) / US | Phone numbers, message content, delivery status | SCCs, Twilio DPA |
| Telegram FZ-LLC | Message delivery via Telegram Bot API | UAE / global | Telegram user IDs, message content | Telegram Bot API Terms |
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|---|---|---|---|
| Authorized Merchant of Record (disclosed at checkout once onboarding completes) | Merchant of Record, payment processing, tax remittance globally, dispute handling | EU / UK / US (depends on chosen MoR) | Customer billing info, payment methods, invoice data | SCCs, PCI DSS, MoR-specific DPA — full details published once MoR is selected |
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|---|---|---|---|
| Sendinblue SAS d/b/a Brevo | Transactional email (account notifications, invoices, system emails) | France (Paris) | Customer email addresses, transactional email content | EU residency, GDPR compliant by design |
| Sub-processor | Service | Location | Data Accessed | Safeguards |
|---|---|---|---|---|
| Google LLC (Google Analytics 4) (planned, will be enabled after explicit cookie consent) | Privacy-respecting website analytics | EU regions / US | Anonymized usage events; no individual tracking pre-consent | SCCs, IP anonymization, opt-in via cookie banner |
We update this list when sub-processors change. Customers receive 30-day advance notice for new sub-processors via email. To subscribe to sub-processor updates, email [email protected].