Legal
Subprocessors
Draft. This text has not yet been reviewed by legal counsel and will be finalised before launch.
Hosting and database
Oracle Corporation (Oracle Cloud Infrastructure) — servers for the application, database and encrypted file storage. Location: EU region [[TO FILL: Frankfurt, Germany or Stockholm, Sweden]]. Data: all service data.
Network, security and backups
Cloudflare, Inc. — DNS, TLS encryption, protection against attacks, and the encrypted connection to our servers (Cloudflare Tunnel); R2 object storage with EU jurisdiction for encrypted database backups. Data: network traffic (IP address, request metadata); backups are encrypted with our own key. Transfer basis: EU–US Data Privacy Framework / Standard Contractual Clauses.
Artificial intelligence
Anthropic PBC (Claude API) — writing report drafts and suggesting values from uploaded documents. Data: questionnaire answers and calculated figures of the report section, uploaded documents. Not used for model training. Location: United States. Transfer basis: EU–US Data Privacy Framework / Standard Contractual Clauses.
Resend, Inc. — delivery of transactional emails (verification and sign-in links, invitations, report and revision notifications). Data: recipient email address, email content. Location: United States [[Legal review: confirm the sending region]]. Transfer basis: EU–US Data Privacy Framework / Standard Contractual Clauses.
Not subprocessors
Virus scanning (ClamAV) and all calculations run on our own servers; no data is sent to third parties for them. An external uptime monitor only checks whether the service answers and receives no personal data. We inform customers at least 30 days before adding or replacing a subprocessor.
Last updated: 24.09.2026