Home›Sub-processors
Sub-processors
Annex III of the Data Processing Agreement. Changes are announced 30 days before they take effect and recorded in the change history.
This page is contractual. Clause 6.2 of the DPA binds us to publish this register and to keep it available at this exact path. If you are assessing us as a supplier, this is the authoritative list — not a marketing summary of one.
Always engaged
These process personal data for every customer.
| Sub-processor | Purpose | Where it processes | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Cloud compute — the application servers | Nuremberg, Germany (EEA) | Within the EEA — no third-country transfer. Art. 28 DPA |
| DigitalOcean, LLC | Managed PostgreSQL — the production database and its backups | Frankfurt, Germany (EEA) | EEA-hosted. DPA + SCCs cover any access from the US parent |
| Cloudflare, Inc. | CDN, TLS-terminating reverse proxy and static hosting — all application traffic transits Cloudflare’s edge | EU and global edge network | DPA + SCCs; EU-US Data Privacy Framework |
| Sinch Mailgun | Transactional and marketing email delivery, and receiving email sent to an organisation’s forwarding and BCC logging addresses | EU region (EU data residency pinned in configuration) | EEA-hosted. DPA + SCCs for any US access |
| Twilio Ireland Limited | SMS delivery for notifications and alerts | Ireland (EEA), with onward processing by Twilio Inc. in the US | DPA + SCCs for US processing |
| Stripe Payments Europe, Ltd. | Subscription payments. Full card details never reach our systems | Ireland (EEA), with onward processing in the US | DPA + SCCs; PCI-DSS Level 1 |
| Google Ireland Limited | Push notification delivery (Firebase Cloud Messaging), and crash reporting and usage analytics on the mobile apps (Crashlytics, Analytics) | EU primary, Google global infrastructure | Google Cloud DPA + SCCs; EU-US Data Privacy Framework |
Push payloads carry record identifiers, not names. A push notification tells the app which record to open; it does not put a customer’s name through Google’s infrastructure.
Engaged only when a feature is enabled
These process data only where the relevant feature is switched on, or the relevant action is taken.
| Sub-processor | Purpose | Where it processes | Safeguard |
|---|---|---|---|
| Anthropic, PBC | AI features, each separately enabled: AI-assisted data import; drafting and summarisation over records; answering staff questions about the organisation’s own records; preparing tasks and notes that a user then confirms; shared-inbox reply drafting | United States | DPA + SCCs; opt-in-gated per feature; API data not used for model training |
| DocuSign, Inc. | Electronic signature, where an organisation configures it | United States | DPA + SCCs |
| Cal.com, Inc. | Booking and scheduling, where an organisation configures it | EU instance | EEA-hosted |
Services an organisation connects — not our sub-processors
An organisation, or one of its users, can connect Intellayer to services of its own choosing. Data then flows to those services on the organisation’s instruction, under the organisation’s own agreement with them. They do not process data on our behalf, so they are not sub-processors under Article 28 — but they are data flows, so they are listed here.
| Service | When | What it receives or does |
|---|---|---|
| Google (Gmail, Google Calendar) and Microsoft (Microsoft 365 mail and calendar) | A user connects their mailbox, and chooses whether to allow sending and calendar sync | We read from, and where allowed send through and write to, the user’s own account at their provider — see section 5 of the Pro privacy policy |
| Xero, Intuit QuickBooks | The organisation connects its accounting file | Invoices, payments and the customer details on them |
| 3CX — the organisation’s own phone system | The organisation adds our template to its 3CX | Its system asks which record has a calling number, and reports each call to us |
| Automation tools and the organisation’s own systems — for example Zapier, Make or n8n | The organisation creates an API key or a webhook | The records and events it requests or subscribes to |
| AI apps a user connects — for example Claude, ChatGPT or Copilot | A user approves the connection | Records that user can see, as the user asks; never lead timelines or calendar events |
| Stripe — the organisation’s own Stripe account | The organisation takes payment when a customer accepts a proposal | The payer pays the organisation through Stripe; card details never reach us. Stripe is separately our sub-processor for our own subscriptions, above |
| Viva — the organisation’s own Viva account | The organisation takes payment for an invoice, or when a customer accepts a proposal | The payer pays the organisation through Viva; card details never reach us |
| WhatsApp Business (Meta) — the organisation’s own number | The organisation connects its WhatsApp Business number | The messages its staff send and receive there, and the customer’s number |
| Viber Business Messages through Infobip or Apifon — the organisation’s own account | The organisation connects its account with one of these providers | The messages its staff send and receive there, and the customer’s number |
| European Commission — VIES, and companies’ public websites | Lead enrichment, in the general CRM | A VAT number, to check it; an ordinary request for a public web page. Nothing about the lead |
What none of them may do
Every sub-processor above is engaged under a written contract with data protection obligations no less protective than the DPA. None of them may use the data for its own purposes, and we remain fully liable to you for each of them — clause 6.5 of the DPA.
We do not sell personal data. There is no advertising network, data broker, or behavioural tracking provider in this list, and there will not be one without the 30 days’ notice and the right to object that clause 6 gives you.
Fonts and other assets
The text typeface is self-hosted. The Material Symbols icon font is still served by Google Fonts, which means a visitor’s IP address and user agent reach Google on page load. That is a disclosure, not a sub-processing relationship, and self-hosting it is in progress. The cookie notice says the same.
Changes
Clause 6.3 of the DPA: at least 30 days’ notice before a new or replacement sub-processor starts, given by updating this page and emailing your organisation’s admin contacts, with the change recorded in the change history. Clause 6.4 gives you the right to object on reasonable data protection grounds; clause 6.6 covers the emergency case where a sub-processor has to be replaced immediately to keep the service secure or running.
To be notified of changes, or to raise an objection: [email protected].