Authorised Sub-Processors
DPA Annex III · Effective 2026-04-22
This page is the canonical public list of sub-processors engaged by ewpire. Per DPA§4.2, material additions or replacements are announced here at least fourteen (14) days in advance and the Controller's billing contact is emailed. Controllers may object on reasonable data-protection grounds within fourteen (14) days.
| # | Sub-Processor | Role | Location | Transfer Mechanism |
|---|---|---|---|---|
| 1 | Hetzner Online GmbH | VPS hosting | Germany (EEA) | Intra-EEA |
| 2 | Cloudflare, Inc. | CDN, DDoS, edge | US / EEA edge | SCC Module 2 + DPF |
| 3 | Alibaba Cloud International (Singapore) Pte. Ltd. | Default LLM (Qwen) + image generation | Singapore / Hong Kong | SCC Module 2 + TIA safeguards |
| 7 | Groq, Inc. | Voice transcription | United States | SCC Module 2 |
| 8 | Stripe Payments Europe, Ltd. | Subscription billing and Connect payouts | Ireland (EEA) | Intra-EEA; onward DPF |
| 9 | Resend, Inc. | Transactional email | United States | SCC Module 2 |
| – | Anthropic / OpenAI / Google | BYOK-elected LLM | – | Not ewpire sub-processors.Per §1.4, BYOK-elected providers are engaged by the Controller directly under separate processor agreement. |
Notes
Sub-processors are engaged only as required by Controller configuration. Anthropic, OpenAI, and Google appear only when the Controller elects that LLM via BYOK and contracts with the provider directly under DPA §1.4 Exclusions.
Deferred (future re-activation).Meta Platforms Ireland Ltd., Twilio Inc., and 360dialog GmbH will be added when the WhatsApp messenger channel is restored to the Service. Controllers will receive not less than thirty (30) days' advance notice in accordance with DPA §4.2.
Object to a sub-processor change
Email [email protected] with subject “Sub-processor objection – [your company name]”, citing the specific sub-processor and your data-protection ground. We will respond within five (5) business days.