Sub-processors
This page is the complete list — the single source of truth. The privacy policy, the GDPR page, the DPA and the security page all point here; if you spot a discrepancy anywhere, this page prevails.
30 days’ advance notice of every change
At least 30 days before engaging a new sub-processor we email the billing contacts of accounts and update this page. A customer acting as controller may object within 30 days of the notice, stating its reasons — section 7 of the DPA governs what happens then.
Subscribe to the notices: (subject: “Sub-processor notices”)
1. Active sub-processors
List last modified: 31 July 2026. The “Contracting entity” column shows which company we contract with — for assessing transfers this is what matters, not where the server physically sits.
| Provider | What we use it for | Contracting entity | Where data is stored | Transfer basis |
|---|---|---|---|---|
| Hetzner Online GmbH DPA | Application hosting (Kubernetes cluster), Redis cache | Germany | Germany (Falkenstein / Nuremberg) | No transfer — EU entity, EU data centre |
| OVH Hosting Limited DPA | Managed MongoDB database — storage of all operational data | Ireland (Dublin) — the contracting entity | France (Gravelines) — the data centre | No transfer — EU entity, EU data centre |
| Mollie B.V. DPA | Payment processing (card, SEPA, iDEAL) | Netherlands (Amsterdam) | EU | No transfer — EU entity, EU storage |
| Billingo Technologies Zrt. DPA | Electronic invoicing and reporting to the Hungarian tax authority (NAV) | Hungary | Hungary | No transfer — EU entity, EU storage |
| Tarhely.eu / EZIT Kft. DPA | Email delivery (SMTP relay at mail.cadensa.io), domain services | Hungary | Hungary | No transfer — EU entity, EU storage |
| Plausible Insights OÜ DPA | Cookie-free, identifier-free website analytics on the public site | Estonia (Tallinn) | EU (Germany) | No transfer — EU entity, EU storage |
| Vercel Inc. DPA | Serving the static files of the website and the application (hosting + CDN). Stores no customer data: API calls go directly to the EU backend. | ⚠️ United States (Delaware) — the contracting entity is US-based | EU edge region (fra1, Frankfurt) | Data stays in the EU, but the entity is US-based (CLOUD Act exposure). Basis: Vercel DPA + SCCs. Data involved: IP address, user agent, request metadata. |
| Wasabi Technologies LLC DPA | Object storage: (1) encrypted database backups on a rotating schedule, (2) invoice PDF archive under WORM Object Lock. The two live in separate buckets. | ⚠️ United States (Massachusetts) — the contracting entity is US-based | Germany (eu-central-2, Frankfurt) | Data stays in the EU, but the entity is US-based. Basis: Wasabi DPA + SCCs. Backups are encrypted with AES-256-GCM before upload — the key stays with us, so Wasabi cannot read them. |
2. What is deliberately not on the list
Google LLC — Google Calendar integration
Google is not our sub-processor, because it does not act on our instructions. When you connect your own Google account via OAuth, Google is an independent controller for its own service. The integration is optional, off by default, runs with read-only scope, and can be revoked at any time. The transfer relies on the Article 45 adequacy decision (EU–US Data Privacy Framework).
Formbricks
The engine behind our feedback and support surveys is self-hosted (surveys.cadensa.io, Hetzner DE), so no external provider sits behind it. The widget stores a marker in your browser for which surveys you have seen — that requires consent to the functional category.
CDN, WAF and analytics vendors
There is no Cloudflare, no Google Analytics, and no advertising or social media pixel in the service. Static delivery of the website runs on the Vercel edge (see above); the application’s API traffic goes straight to the Hetzner cluster.
3. On the US entities, plainly
Two of our sub-processors are US-incorporated companies: Vercel and Wasabi. Both store in an EU region, but their parent companies sit under US jurisdiction, so CLOUD Act exposure exists in principle. We would rather say so than claim a “100% EU chain” that a thorough buyer disproves in five minutes.
- • Time entries, projects and reports — the substance of customer data — reach neither US entity: they live in the Hetzner cluster and the OVHcloud database.
- • The backups stored at Wasabi are encrypted before upload, and the key never leaves our side.
- • We have carried out a transfer impact assessment (TIA) for both providers; we share it on request for procurement.
Related Documents:
Language of this document
This document is authored in English and Hungarian. On other language interfaces the English text is shown. In case of any discrepancy between the two versions, the English text prevails — except where the contracting party is a consumer resident in Hungary, in which case the Hungarian version applies. If you spot a discrepancy between the versions, please tell us at legal@cadensa.io and we will fix it.