Legal
Sub-processors
DRAFT — pending operator legal review. This text has not been approved by the site operator and may change before publication.
Processor: [[ to be supplied: legal entity name ]], operating TENSOR.
This page lists every third party that processes tenant data on our behalf. It is canonical: a sub-processor that is not listed here is not used.
You are notified at least 30 days before a sub-processor is added or removed. Material changes to a sub-processor's data residency or certifications are notified as soon as practical.
Where tenant data lives
- Tenant database — Frankfurt or Falkenstein, Germany; backups in the same jurisdiction.
- Object storage for attachments and exports — EU-only jurisdictional configuration.
- No tenant primary data is processed outside the European Economic Area unless you configure it that way yourself.
Platform sub-processors
These apply to every tenant. Two rows name a decision that has not been made yet, and say so — they are settled before the first commercial tenant.
| Sub-processor | Role | Location | Residency |
|---|---|---|---|
| Hetzner Online GmbH | Primary compute and database hosting; backup targetGerman jurisdiction. ISO 27001. | Falkenstein and Nuremberg, Germany | EU |
| Cloudflare, Inc. | CDN, DDoS protection, TLS termination, object storage (R2), DNSEdge nodes are worldwide for performance, so transient request data passes through them while primary data stays at the EU origin. Cloudflare is US-incorporated, and that boundary is stated rather than glossed. | R2 configured for EU jurisdiction; origin in the EU | EU origin |
| WorkOS | Identity federation — SAML, OIDC, SCIM directory sync, MFA enforcementSOC 2 Type II, ISO 27001. | EU data residency, configured for this deployment | EU region |
| Inngest Inc. | Durable workflow execution — SLA timers, escalation, reporting cascades, change approvalsCarries references only. No tenant primary data transits Inngest. | EU region | EU region |
| Postmark (ActiveCampaign LLC) | Transactional email — notifications, password reset, regulatory deadline remindersMessage content may include ticket titles and short descriptions. | EU servers | EU region |
| Axiom | Log aggregation, metrics, tracing, and PII-free product-analytics eventsPII is scrubbed at the OpenTelemetry collector before transmission. SOC 2 Type II in progress. | EU region | EU region |
| Sentry (Functional Software, Inc.) | Error tracking and aggregationPII scrubbed before transmission. SOC 2 Type II, ISO 27001. | EU region | EU region |
| GitHub (Microsoft Corporation) | Source-code hosting and CI/CDThe only US-jurisdictional entry in this list. It processes no tenant data — source code and CI logs only — and is listed for completeness rather than omitted to keep the table tidy. | US for repositories; EU-region runners for CI | US — no tenant data |
| Managed Postgres — Neon, or self-hosted on Hetzner | Tenant database hostingThe choice between managed Neon and Hetzner-hosted Postgres is made before the first commercial tenant. Both options are EU-resident; this row will name one provider once the decision is recorded. | EU region (Frankfurt) either way | Not yet selected |
| Secrets management — Doppler, or self-hosted Infisical | Application secrets storage and rotationHandles API keys, database credentials, and encryption keys — not tenant data. Decided before the first commercial tenant. | Doppler EU region, or Infisical self-hosted in Germany | Not yet selected |
Sub-processors you switch on yourself
An integration becomes a sub-processor for your tenant only when you enable it, and for no one else. Where a vendor defaults to US residency, you acknowledge that explicitly before the integration activates.
| Sub-processor | Role | Location | Residency |
|---|---|---|---|
| Microsoft — Graph, Sentinel, Teams, Intune | Identity, security, collaboration, endpoint management | Follows your own Microsoft 365 / Azure region selection | EU region |
| Datadog | Monitoring and APMYou declare the region at integration setup. | EU site (datadoghq.eu) or US site | EU region |
| CrowdStrike | Endpoint detection and response | EU-1 region available | EU region |
| Tenable.io / Qualys / Rapid7 | Vulnerability managementAn on-premises Rapid7 InsightVM console involves no Rapid7 sub-processor at all. | EU instances available for all three | EU region |
| Citrix Cloud | Virtual apps and desktops | EU region available | EU region |
| SAP | S/4HANA Cloud, BTP, Cloud ALMRunning SAP on-premises involves no SAP sub-processor — the platform connects to your own system. | EU regions for those services | EU region |
| Veeam | Backup state and restore-test datesWith Veeam Cloud Connect, residency follows your Veeam Cloud provider. | Typically self-hosted by you | EU region |
| PagerDuty | On-call and alertingYou acknowledge the residency implication before the integration activates. | US by default; EU region on selected plans | US — no tenant data |
| Slack Technologies | CollaborationOn non-Grid plans you must explicitly acknowledge US data residency to enable Slack. | US by default; EU residency on Enterprise Grid | US — no tenant data |
Not used, so you don't have to ask
- AWS, Google Cloud, Microsoft Azure — not used as primary infrastructure, specifically to avoid a US-jurisdictional dependency for tenant primary data.
- Commercial LLM providers — not used in production tenant-data paths. Semantic search runs on an EU-hosted embedding model; any future use is added here with prior notice and per-tenant opt-in.
- Twilio, SendGrid, Mailgun — not used for transactional email.
- HubSpot, Salesforce, Segment — not used in tenant-data paths.
When this list changes
- The candidate is evaluated against EU residency, a certification floor of SOC 2 Type II or ISO 27001, and DPA terms.
- The decision and the alternative considered are recorded in an architecture decision record.
- This page is updated.
- Affected customers are notified at least 30 days before processing begins.
- You may object during the 30-day window; an objection triggers a documented review.
Current copies of each sub-processor's certifications are available on request.