Snapshot 253543
Parsed
What we read from this document, as JSON. Each entry names the snapshot it was read from.
{
"entries": [
{
"kind": "subprocessor",
"vendor": "amazon-web-services",
"evidence_id": 223712,
"data": {
"name": "Amazon Web Services",
"domain": "aws.amazon.com",
"purposes": [
"AWS hosts all Customer Personal Data stored in the Twenty CRM — including contacts, companies, notes, activities, attachments — together with related backups and logs. Data is hosted in Germany (Frankfurt, eu-central-1). AWS is always engaged."
],
"data_categories": [
"PII"
]
}
},
{
"kind": "subprocessor",
"vendor": "anthropic",
"evidence_id": 223712,
"data": {
"name": "Anthropic",
"domain": "anthropic.com",
"purposes": [
"Anthropic processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action — in which case only the specific records or text needed for that action are sent. When AI features are disabled, Anthropic is not a sub-processor. Processed in the United States. Customer data is not used to train Anthropic's models. Transfers are covered by the EU Standard Contractual Clauses."
],
"data_categories": [
"PII"
]
}
},
{
"kind": "subprocessor",
"vendor": "microsoft",
"evidence_id": 223712,
"data": {
"name": "Azure",
"domain": "azure.microsoft.com",
"purposes": [
"Microsoft Azure provides Azure Foundry inference for Twenty AI features when requests are routed to Azure. Data may include prompts, responses, and CRM content supplied as context. Processing locations depend on the model and deployment: Global deployments may process outside the EU even when the Azure resource is in Germany. Retention and abuse monitoring depend on the service and approved account configuration."
]
}
},
{
"kind": "subprocessor",
"vendor": "clickhouse",
"evidence_id": 223712,
"data": {
"name": "ClickHouse",
"domain": "clickhouse.com",
"purposes": [
"ClickHouse stores Twenty's audit logs, which record activity within the CRM and can contain Customer Personal Data (for example, the content or identifiers associated with a logged action). Processed in Germany. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses where applicable."
],
"data_categories": [
"PII"
]
}
},
{
"kind": "subprocessor",
"vendor": "cloudflare",
"evidence_id": 223712,
"data": {
"name": "Cloudflare",
"domain": "cloudflare.com",
"purposes": [
"Cloudflare processes Customer Personal Data only in transit — request and response content — together with connection metadata such as IP addresses and request headers, in order to route, cache, and protect traffic. As a content delivery network, processing occurs worldwide across Cloudflare's global edge network. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework."
]
}
},
{
"kind": "subprocessor",
"vendor": "google-cloud",
"evidence_id": 223712,
"data": {
"name": "Google Cloud Platform",
"domain": "cloud.google.com",
"purposes": [
"Google provides Maps look-ups, Google sign-in, and Gemini models for Twenty AI features when the relevant Google service is used. Data may include address or location queries, authentication information, and, for Gemini inference, prompts, responses, and CRM content supplied as context. Processing locations and data-handling terms depend on the Google service and API used; this entry does not guarantee Germany-only processing for Gemini."
],
"data_categories": [
"PII"
]
}
},
{
"kind": "subprocessor",
"vendor": "mistral",
"evidence_id": 223712,
"data": {
"name": "Mistral",
"purposes": [
"Mistral processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, Mistral is not a sub-processor. Processed in France. Customer data is not used to train Mistral's models. As an EU-based provider with EU hosting, no transfer outside the EEA is required for this processing."
]
}
},
{
"kind": "subprocessor",
"vendor": "openai",
"evidence_id": 223712,
"data": {
"name": "OpenAI",
"domain": "openai.com",
"purposes": [
"OpenAI processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, OpenAI is not a sub-processor. Processed in the United States and the EU. Customer data is not used to train OpenAI's models. Transfers are covered by the EU Standard Contractual Clauses."
]
}
},
{
"kind": "subprocessor",
"vendor": "sentry",
"evidence_id": 253543,
"data": {
"name": "Sentry",
"domain": "sentry.io",
"purposes": [
"Sentry receives error and performance events, including stack traces and request context. Customer Personal Data is not expected to be included, but it may incidentally appear if present at the moment an error occurs; Twenty minimizes this through data scrubbing. Processed in the European Union (Frankfurt, Germany). Always engaged. Sentry is a US company, so any remote access from outside the EU, for example for support, is covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework."
],
"data_categories": [
"PII"
]
}
},
{
"kind": "subprocessor",
"vendor": "typesafe-ai",
"evidence_id": 223712,
"data": {
"name": "TypeSafe",
"domain": "typesafe.ai",
"purposes": [
"Typesafe AI, Inc. provides AI evaluation and monitoring. Data may include prompts, responses, and contextual CRM data in AI interactions submitted for evaluation. Processing locations, retention, and applicable contractual safeguards are being verified."
]
}
}
]
}