Legal
Sub-processors
Last updated: [DATE]. Kept current at this stable URL, per the Data Processing Agreement §6.3. This page updates on its own when a sub-processor changes, without needing to republish that whole document.
Draft, pending legal review
This list is prepared for internal review, not a finalized or legally reviewed document. It should not be relied upon as binding until reviewed by qualified counsel.
This applies to the Cloud Service only. A Self-Hosted deployment is its own controller and processor (or engages its own processors) for whatever infrastructure you run it on. Decretum has no visibility into or access to that data, so none of the below applies to it. If a new sub-processor is added, or an existing one changes, an Organization's Admins receive at least 30 days' notice before it starts processing Customer Personal Data (Data Processing Agreement §6.3).
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting (compute, CDN) | Application compute runs in Vercel's Frankfurt, Germany region (fra1/eu-central-1). Vercel Inc. itself is a U.S. company and may access data from the U.S. for support,
monitoring, and account administration regardless of compute region. | EU-U.S. Data Privacy Framework (Vercel Inc. is DPF-certified); Standard Contractual Clauses as a fallback, per Vercel's own DPA (vercel.com/legal/dpa) |
| Neon, Inc. | Database hosting (managed PostgreSQL, running on AWS infrastructure) | Database provisioned in AWS eu-central-1 (Frankfurt, Germany); data at rest and query
processing occur in that region. Neon, Inc. (a Delaware corporation) may access data from the
U.S. for support, monitoring, and account administration. | EU-U.S. Data Privacy Framework (Neon, Inc. is DPF-certified); Standard Contractual Clauses as a fallback, per Neon's own DPA |
| Amazon Web Services, Inc. | File attachment storage (Amazon S3) | eu-central-1 (Frankfurt, Germany) | Not applicable: data stored in this region does not leave the EEA. AWS's GDPR Data Processing Addendum separately incorporates the Standard Contractual Clauses for any AWS processing that does occur outside the EU. |
| Zoho Corporation B.V. | Transactional email delivery: sign-in codes, invitations, notifications and digests (via Zoho CPaaS, formerly ZeptoMail) | Utrecht, Netherlands; per Zoho's own DPA, personal data for this account is stored in Zoho's EEA data centers. | Not applicable for the primary storage/sending leg: data does not leave the EEA. Zoho's own DPA separately incorporates the Standard Contractual Clauses for any processing its non-EEA group entities or sub-processors perform. |
| Google Ireland Limited | Optional sign-in identity provider (only if a User chooses this sign-in method) | Dublin, Ireland. Google's own terms designate Google Ireland Limited as the contracting entity for EEA users. Google LLC (the U.S. parent) may access data from the U.S. for support and account administration. | EU-U.S. Data Privacy Framework (Google LLC is DPF-certified); Standard Contractual Clauses as a fallback, per Google's own data processing terms |
| Microsoft Ireland Operations Limited | Optional sign-in identity provider (only if a User chooses this sign-in method) | Dublin, Ireland. Microsoft's own Services Agreement designates Microsoft Ireland Operations Limited as the contracting entity for users in the EU, Iceland, Liechtenstein, Norway, Switzerland, or the UK. Microsoft Corporation (the U.S. parent) may access data from the U.S. for support and account administration. | EU-U.S. Data Privacy Framework (Microsoft Corporation is DPF-certified); Standard Contractual Clauses as a fallback, per Microsoft's own data processing terms |
Questions about this list can be sent to support@decretum.app.