Sub-processors

This is the agreed list of sub-processors under Clause 7.7(a), Option 2, of the Data processing agreement: the providers domusdesk entrusts with part of the processing on behalf of the organisations that use it. For each: the legal entity, the purpose, the data it sees, where the processing takes place, the transfer mechanism to third countries and the status on the official EU-US Data Privacy Framework list. Every addition or replacement is published here and notified by email to every organisation's OWNERs at least 14 days in advance.

An organisation that intends to object to an addition or a replacement writes, within the 14 days, to portezuelos.info@gmail.com

• Vercel · Vercel Inc. (US)Provider's terms

  Purpose

  Hosting of the application and its functions; the shopfront's custom domain.

  Data processed

  Every request to the application passes through its functions; request logs (IP addresses, paths) and builds.

  Place of processing

  Functions in Frankfurt (fra1); builds and logs in the United States.

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Certified (Active) · expires April 29, 2027

  Listed since

  October 14, 2026

• Neon · Neon, LLC (Databricks, Inc.) (US)Provider's terms

  Purpose

  PostgreSQL database: all of the organisation's data, with point-in-time recovery.

  Data processed

  Everything recorded in the software: people, properties, contracts, documents (metadata), anti-money-laundering files (identity parts encrypted), logs.

  Place of processing

  AWS eu-central-1 (Frankfurt).

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Covered by the certification of Databricks, Inc. · expires August 10, 2027

  Listed since

  October 14, 2026

• Scaleway · Scaleway SAS (FR)Provider's terms

  Purpose

  Store of the uploaded documents and photographs; the public copy of the photos approved for the shopfront.

  Data processed

  The uploaded files: identity documents, contracts, photographs; the derived public copies of approved photos.

  Place of processing

  European Union (Paris and Amsterdam); sub-processors in the Union.

  Transfer

  No transfer: provider and processing in the European Union.

  Data Privacy Framework

  Not applicable or not checked

  Listed since

  October 14, 2026

• Backblaze · Backblaze, Inc. (US)Provider's terms

  Purpose

  Backup copy of the document store, under separate credentials.

  Data processed

  A copy of the same files; domusdesk's account data.

  Place of processing

  Files in the EU-Central data centre (Amsterdam); account data in the United States.

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Certified (Active) · expires December 1, 2026

  Listed since

  October 14, 2026

• Upstash · Upstash, Inc. (US)Provider's terms

  Purpose

  Rate limits (sign-in, sign-up, public calls).

  Data processed

  IP addresses and request identifiers, for a few minutes.

  Place of processing

  European region; account data in the United States.

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Certified (Active)

  Listed since

  October 14, 2026

• Resend · Plus Five Five, Inc. (US)Provider's terms

  Purpose

  Transactional email (verification, invitations, reminders, alerts).

  Data processed

  The recipient's email address, the subject and body of the message, delivery metadata.

  Place of processing

  Sending from eu-west-1 (Ireland); account data, metadata and logs in the United States.

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Certified, re-certification under review · expires March 3, 2027

  Listed since

  October 14, 2026

• Sentry · Functional Software, Inc. (US)Provider's terms

  Purpose

  Error monitoring of the application.

  Data processed

  Technical details of errors; personal data is stripped before sending (no document, no file).

  Place of processing

  Events in Frankfurt; account and audit log in the United States.

  Transfer

  EU-US Data Privacy Framework, with the standard contractual clauses (Decision 2021/914) as the fallback.

  Data Privacy Framework

  Certified (Active) · expires May 28, 2027

  Listed since

  October 14, 2026

• Cloudflare Turnstile · Cloudflare, Inc. (US)Provider's terms

  Purpose

  Bot check on the sign-up form (Turnstile).

  Data processed

  IP address and browser signals of the person signing up.

  Place of processing

  Global network.

  Transfer

  The Commission's standard contractual clauses (Decision 2021/914).

  Data Privacy Framework

  Not applicable or not checked

  Only if

  a person signs up from the public form.

  Listed since

  October 14, 2026

• Openapi · Openapi S.r.l. (IT)Provider's terms

  Purpose

  Look-ups on Italian public registers (company and cadastral extracts) when the organisation asks for them.

  Data processed

  The tax code, VAT number or cadastral identifier being looked up.

  Place of processing

  Italy.

  Transfer

  No transfer: provider and processing in the European Union.

  Data Privacy Framework

  Not applicable or not checked

  Only if

  the organisation asks for a look-up on a public register.

  Listed since

  October 14, 2026

• Anthropic · Anthropic, PBC (EU contracting entity: Anthropic Ireland Limited) (US)Provider's terms

  Purpose

  The AI assistant and agents, when the organisation switches them on.

  Data processed

  The text a person writes to the assistant and the data the authorised tools read; never anti-money-laundering files or identity documents. Anthropic deletes inputs and outputs within 30 days; content its safety systems flag may be kept for up to 2 years. Its own sub-processors are listed at trust.anthropic.com/subprocessors.

  Place of processing

  United States (no European region on the direct API).

  Transfer

  The Commission's standard contractual clauses (Decision 2021/914).

  Data Privacy Framework

  Not on the list: the standard contractual clauses alone apply

  Only if

  the organisation switches on the AI assistant or agents.

  Listed since

  October 14, 2026

Back to the Data processing agreement