Snapshot 19030
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Legal
Sub-processors
Last updated: 3 September 2026 · This page is the authoritative current list of sub-processors engaged by Ansvar.
Change log: 3 September 2026: Ansvar added Microsoft Power Platform for the workflow endpoint that delivers SRE Watch and log-review Teams cards. The service operated by 19 August within the existing Microsoft relationship; Ansvar published the per-service disclosure after a supplier review found the omission. 2 September 2026 — the Hetzner Online GmbH entry now itemises the expert-run engagement workspace document store (Helsinki, EEA): customer-uploaded engagement documents, deleted within 30 days of report delivery. The store has operated inside the disclosed Hetzner hosting engagement since 9 June 2026; Ansvar published the per-service disclosure late, on 2 September 2026, after an internal audit finding. 12 August 2026 — added Scaleway S.A.S. (Object Storage) as off-site backup storage: a daily add-only, write-once mirror of infrastructure backups in France (EEA), running alongside the existing Azure Blob mirror while backup storage migrates to Scaleway. The mirror has been in operation since 12 July 2026; this roster entry was published late, on 12 August 2026. 27 July 2026 — DigiCert, Inc. removed from the sub-processor roster and reclassified as an ancillary recipient: it receives only the daily aggregate Merkle root hash and Processes no Personal Data on Ansvar's behalf, so it is not a sub-processor under Article 28 GDPR; the disclosure is retained under "Ancillary recipients". 23 July 2026 — added links to each sub-processor's own data-processing terms (no change to the roster). 9 July 2026 — added Microsoft Ireland Operations Limited (Azure Blob Storage, off-site backup storage in the EEA).
This page lists the sub-processors that Ansvar Systems AB ("Ansvar") engages to Process Personal Data on behalf of its customers in connection with the Ansvar Gateway and related services. The Current sub-processors table below is the authoritative, up-to-date list and is the list incorporated into Annex 3 of the Data Processing Addendum; the separate Ancillary recipients disclosure is published for transparency and is not incorporated into Annex 3. Ansvar remains liable to the customer for the acts and omissions of its sub-processors.
Current sub-processors
Name Role / service Address of establishment Location(s) of the Processing Transfer mechanism
Hetzner Online GmbH Cloud compute, private networking, load balancing, and volumes for prod-ansvar in hel1; Object storage for corpus delivery, database and recovery backups, security archives, and source mirrors; Object storage for expert-run engagement documents (bucket ansvar-engagements, hel1 — customer-uploaded architecture material and delivered reports; asset A-078; retention per ANSVAR-008 DP-P9); Storage Box retaining encrypted historical Borg archives from the retired compose plane; Cloud compute for the development/agent host, SIEM host, and ephemeral build runner Industriestr. 25, 91710 Gunzenhausen, Germany Finland (Helsinki) — production Kubernetes cluster (compute, hosting, key-management, and the audit-ledger database); Germany (Falkenstein) — encrypted off-site backups (Storage Box); Finland (Helsinki) — engagement workspace object storage (bucket ansvar-engagements, hel1; deleted within 30 days of report delivery, 90-day lifecycle backstop); Finland (Helsinki) — development/agent host, SIEM host (security-log processing), and the ephemeral build runner None required — processing within the EEA
Cloudflare, Inc. CDN and edge proxy for registered proxied hostnames; WAF controls available under the registered Free plan; DDoS protection; TLS termination; Rate limiting 101 Townsend Street, San Francisco, CA 94107, USA EU edge (TLS termination) + US routing Terminates TLS and processes traffic in transit at the EU edge; some routing/processing may occur in the US. Covered by the EU-US Data Privacy Framework (Cloudflare self-certified) + EU SCCs (Module 2/3) as fallback.
Microsoft Ireland Operations Limited (Azure Blob Storage) Off-site backup storage (Azure Blob) — daily add-only write-once mirror of infrastructure backups incl. database backups One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland North Europe region (Ireland, EEA) None required — storage within the EEA; limited onward transfer to Microsoft Corp. (US) possible for support/telemetry, covered by EU SCCs + EU-US Data Privacy Framework (Microsoft self-certified)
Microsoft 365 Productivity, email, and support tooling (Microsoft 365) One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland EU Data Boundary (EEA); limited onward to Microsoft Corp. (US) for support/telemetry EU SCCs + EU-US Data Privacy Framework (Microsoft self-certified); EU Data Boundary minimises transfers
Microsoft Power Platform Power Platform workflow endpoint for SRE Watch and log-review Teams cards One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland EU Data Boundary (EEA); limited onward to Microsoft Corp. (US) for support/telemetry EU SCCs + EU-US Data Privacy Framework (Microsoft self-certified); EU Data Boundary minimises transfers
Scaleway S.A.S. (TEM) Transactional email (platform + marketing website notifications) 8 rue de la Ville l'Évêque, 75008 Paris, France France (fr-par region) None required — processing within the EEA
Scaleway S.A.S. (Object Storage) Off-site backup storage (Object Storage) — daily add-only write-once mirror of infrastructure backups incl. database backups (object lock) 8 rue de la Ville l'Évêque, 75008 Paris, France France (fr-par region, EEA) None required — processing within the EEA
Stripe Gateway billing (Stripe Checkout); Subscription webhook -> Keycloak user provisioning 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland Primarily Ireland (EEA); onward to Stripe, Inc. (US) for some processing EU SCCs + EU-US Data Privacy Framework (Stripe, Inc. self-certified)
Ancillary recipients — not sub-processors
The party below receives data from Ansvar in connection with the Services but does not Process Personal Data on Ansvar's behalf. It is therefore not a sub-processor under Article 28 GDPR and does not form part of Annex 3. It is disclosed here for transparency. See Annex 4 (Audit Ledger), A4.8 for the integrity-and-timestamping detail.
Name Role / service Address of establishment Why it is not a sub-processor
DigiCert, Inc. RFC-3161 trusted timestamping of the daily aggregate Merkle root imprint (audit-ledger integrity) 2801 North Thanksgiving Way, Suite 500, Lehi, UT 84043, United States Processes no Personal Data on Ansvar's behalf — receives the daily aggregate Merkle root imprint + RFC-3161 protocol metadata only, not reversible (DPA Annex 4 A4.8); reclassified from the roster 2026-07-27 with the reasoning on the page changelog
Scope notes
Ledger Data and other customer Personal Data are stored and Processed within the EEA, save the aggregate Merkle root hash described above (which contains no Personal Data).
Each sub-processor's own data-processing terms
For vendor due diligence — verifying our Article 28 chain, or building your own — each sub-processor publishes its data-processing terms here. These links are provided for reference only: they are not incorporated into the DPA or this Annex, and the linked vendor terms do not modify Ansvar's obligations under the DPA.
Hetzner Online GmbH — Data Processing Agreement (PDF)
Microsoft — Microsoft Products and Services Data Protection Addendum (covers both Azure Blob Storage and Microsoft 365)
Cloudflare, Inc. — Customer Data Processing Addendum
Stripe — Data Processing Agreement
Scaleway — contracts page (a dedicated Data Processing Agreement is listed there)
DigiCert, Inc. is not a sub-processor (see Ancillary recipients above) and receives only the daily aggregate Merkle root hash, so its terms are not listed here.
Changes to this list
Ansvar provides prior written notice to customers of any intended addition or replacement of a sub-processor at least fifteen (15) calendar days before the change takes effect, and customers may object within ten (10) calendar days on reasonable data-protection grounds specific to the relevant sub-processor, in accordance with the "Sub-processors" section of the DPA. To be notified of changes, or to raise an objection, contact [email protected].
Related terms
See the Data Processing Addendum for the full GDPR Article 28 processing terms, the Privacy Notice for processing where Ansvar acts as controller, and the Terms of Service for the general subscription terms.