| Supabase Pte. Ltd. (Singapore), part of Supabase, Inc. (Delaware, USA) | Database, user accounts and file storage | Processed in Paris; the processor is established in Singapore and the group is US-owned | European Commission Standard Contractual Clauses (Decision (EU) 2021/914), modules 2 and 3, per the vendor’s data processing addendum |
| Microsoft Ireland Operations Limited (Ireland) | Reading the company’s shared mailboxes (incoming post) | EU/EFTA under Microsoft’s EU Data Boundary | European Commission Standard Contractual Clauses (Decision (EU) 2021/914) for such transfers to third countries as occur; Microsoft is also certified under the EU-US Data Privacy Framework |
| AC PM LLC (ActiveCampaign, USA) | Sending email | USA — Deft outside Chicago and AWS. Postmark offers no EU data location | European Commission Standard Contractual Clauses (Decision (EU) 2021/914), modules 2 and 3; AC PM is also certified under the EU-US Data Privacy Framework |
| No Ink AB (Ekopost, Sweden) | Printing and dispatch of physical letters | Sweden | Not applicable — EU |
| Telnyx LLC (USA) | Telephony and call recordings | Processed in Amsterdam; the vendor is established in the USA | European Commission Standard Contractual Clauses (Decision (EU) 2021/914) |
| Mistral AI (France, reg. no. 952 418 325) | AI assistance in case handling | Paris [TO BE CONFIRMED: Mistral’s own sub-processors] | Not applicable to Mistral itself — EU. Transfers by Mistral’s sub-processors take place under the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) |
| OVH SAS (Roubaix, France) | Server operations | France (Roubaix) — the RBX2 data centre | Not applicable — EU |
