Sub-processors
Annex to the Data Processing Agreement. Last updated: 7 November 2026.
1. Who processes what
Change in progress
From 8 November 2026, new organisations are provisioned on the hosting in Vienna, Austria. Organisations that were already live are migrated on 8 December 2026, when the 30 days of notice under section 5 of the processing agreement have run. Until the migration is complete, both operators appear in the table below.
Ashio runs the reporting channel on its own infrastructure and uses the providers below. Each is bound by obligations no less protective than the processing agreement, may process the data only on documented instructions, and may not use it for its own purposes.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| netcupnetcup GmbHFrom 8 November 2026 | Hosting and database infrastructure | All application data: case content, accounts, settings, billing metadata and the deployment. Report bodies and attachments are ciphertext before they reach the server. | Vienna, Austria |
| InfomaniakInfomaniak SAUntil 8 December 2026, for organisations live before 8 November 2026 | Hosting and database infrastructure | All application data: case content, accounts, settings, billing metadata and the deployment. Report bodies and attachments are ciphertext before they reach the server. | Geneva, Switzerland |
| ResendPlus Five Five, Inc. | Transactional email: invitations, report alerts and status notifications | Email addresses and the notification text. No report bodies. | Ireland |
| SentryFunctional Software, Inc. | Error monitoring | Technical error data. No report content. | Frankfurt, Germany |
Resend and Sentry run inside the EEA, and so does the hosting in Vienna, so no personal data of a new organisation is transferred to a third country. Switzerland, where the data of organisations that were live before 8 November 2026 still sits until 8 December 2026, benefits from an EU adequacy decision, so that storage needs no additional safeguards either. Should a provider outside the EEA be added later, the transfer is covered by the Standard Contractual Clauses set out in the Terms of Service, and it is announced here under the 30-day rule above.
2. Changes and notice
We give at least 30 days’ notice before a sub-processor is added or replaced, by email to the billing contact on every account and by publishing the change here. The 30 days start on the date shown in the history below, not on the date the change ships.
| Date | Change | Effective |
|---|---|---|
| 8 November 2026 | Hosting moves from Infomaniak SA in Geneva to netcup GmbH in Vienna, Austria. New organisations are provisioned there from 8 November 2026. Organisations that were already live move on 8 December 2026, when the 30 days of notice have run. Same purpose, same encryption, and the list otherwise unchanged. | 8 December 2026 |
| 6 November 2026 | Support chat moved from Chatwoot Cloud to our own infrastructure at chatwoot.ashio.eu. Chatwoot is no longer a sub-processor; it runs on the hosting in row one. | Immediately |
| 6 November 2026 | This page published, and the list moved here from section 5 of the processing agreement. No provider changed. | Immediately |
3. Right to object
If a change is not acceptable to you, you may object on reasonable data protection grounds within the 30 days. Objections are handled by email, and one message is enough:
Object to a sub-processor change
- Include your organisation, the provider in question, the grounds for the objection, and the date of the notice. The link above opens an email with those fields already laid out.
- While an objection is open we do not engage that provider for your account.
- If we cannot find a solution, you may terminate the affected service and we refund the unused part of the term, as Article 28(2) GDPR provides.
4. Related documents
The processing agreement is the DPA; the technical and organisational measures, including the encryption of report bodies and attachments, are described on the security page. Questions about this list: legal@ashio.eu.