1. How this list works
1.1 A supplier is only a sub-processor for a customer if it processes that customer's personal data for a service the customer uses. The Services column shows when that is the case.
1.2 Infaris announces changes at least 30 days in advance, as article 5 of the data processing agreement provides. The customer may object with reasons within 14 days.
2. Infrastructure
| Supplier | Services | Purpose and data | Location | Transfer basis |
|---|---|---|---|---|
| OVH SAS | All | Servers for the Infaris applications and their databases | EEA | Not needed (EEA) |
| DigitalOcean LLC | Guard | Monitoring worker in the US for measurements from a US location; processes the addresses measured and the results | United States | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Cloudflare Inc. | All | DNS, CDN, WAF, DDoS protection, Turnstile, R2 object storage for encrypted backups; IP addresses and request data | Global network | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Vercel Inc. | Hosting, some websites | Edge platform for static sites; IP addresses and request data | Global, function region configurable | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Hetzner Online GmbH | Hosting | Standby servers and storage of encrypted backups of hosted sites | Germany and Finland | Not needed (EEA) |
| BunnyWay d.o.o. (bunny.net) | Hosting | Authoritative DNS and health checks for customer domains; DNS records and resolver IP addresses | EU company, global anycast network | Supplier's data processing agreement, with standard contractual clauses where data leaves the EEA |
| Hosting Concepts B.V. (Openprovider) | Hosting | Registration and management of domain names; registrant details | Netherlands | Not needed (EEA) |
| Daytona Platforms Inc. | Guard, Hosting | Isolated work environments: building the code of customer sites (Hosting) and the workspace of PandaBot agents (Guard) | Per the data processing agreement | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Redis Ltd. (Redis Cloud) | Infaris account, Files | Rate limiting and temporary technical keys | Per the data processing agreement | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Microsoft Ireland (Azure Blob Storage) | Files | Encrypted storage of shared files | EU | Not needed (EU) |
| Neon Inc. | Files | Database with share metadata | Per the data processing agreement | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Supabase Inc. | Design | Database and storage | Per the data processing agreement | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
3. Communication
| Supplier | Services | Purpose and data | Location | Transfer basis |
|---|---|---|---|---|
| Resend Inc. | All | Transactional e-mail, such as sign-in links, invitations and alerts; e-mail address and message content | Per the data processing agreement | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
| Own mail server (mail.ipulse.one) | All | Transactional e-mail and Calendar webmail | Own management, EEA | Not applicable |
| Slack Technologies | Guard (when the customer connects Slack), internal | Alerts to a customer's Slack channel; internal operational alerts without customer datasets | United States | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
4. Payments
| Supplier | Services | Purpose and data | Location | Transfer basis |
|---|---|---|---|---|
| Stripe Payments Europe Ltd. | All paid subscriptions | Payments, subscriptions and invoices; name, e-mail, company details, payment details | Ireland, with transfer to Stripe Inc. | Data Privacy Framework and SCCs in the Stripe DPA |
5. AI features
Only applies if the customer uses AI features, such as PandaBot, root cause analysis, predictions or AI steps in automations. Which model answers a question depends on the model selection in Guard.
| Supplier | Services | Purpose and data | Location | Transfer basis |
|---|---|---|---|---|
| Anthropic PBC | Guard | Default PandaBot model (Claude); prompts with data from the Organization | United States | Data processing agreement with standard contractual clauses; API input is not used for training |
| OpenAI | Guard | Models via the API, and speech to text and back for the chat voice feature | United States | Data processing agreement with standard contractual clauses; API input is not used for training |
| Google LLC (Gemini API) | Guard | Gemini models in the model selection | United States / global | Paid API under Google's data processing terms; input is not used for training |
| OpenRouter Inc. | Guard, Sync | Router to models of other providers, including free models. The Sync assistant uses a free model by default; calendar titles are not sent | United States | OpenRouter's data processing agreement. With free models the underlying provider may retain the input or use it for training |
| Vercel Inc. (AI Gateway) | Guard | Router to models when the gateway key is set | United States | Supplier's data processing agreement, with standard contractual clauses or the EU-US Data Privacy Framework |
Guard and Sync offer free models in addition to paid models, among other things for use beyond the credit for paid models. With those models the provider may retain the input or use it for training; article 11.4 of the terms of service says so. An administrator of the customer can turn free models off for its own organization in the PandaBot settings.
If the customer connects its own API key, the provider of that key is not a sub-processor of Infaris but a supplier of the customer.
6. Optional integrations
If a user or customer chooses an integration, its provider is usually an independent controller rather than a sub-processor:
- Google and Microsoft as sign-in method or calendar link (Sync, Calendar);
- Apple iCloud for calendar sync in Calendar;
- channels and systems the customer connects to Guard, such as Microsoft Teams, ticketing systems and webhooks.
7. Not a sub-processor
These suppliers receive no customer data from the services and are therefore not listed above: GitHub (source code), Notion (internal documentation, without customer data from the services), Google Analytics (only website visits to infaris.com, with consent) and Nextcloud (own management).