Vercel Inc.
Hosting of portal, dashboard and API. Location: EU (Frankfurt); US company, SCC.
Supabase Inc.
Database and file storage. Location: EU region of the project; US company, SCC.
Cloudflare Inc.
Client sites, DNS, protection, file storage (R2), backups. Location: Global network; US company, SCC and DPF.
Resend Inc.
Sending and receiving email. Location: EU (Ireland); US company, SCC.
Mollie B.V.
Payments, direct debit, payment terminals. Location: Netherlands.
Twilio Inc.
SMS and WhatsApp (only with module sms or support). Location: US, SCC.
GitHub Inc.
Source code of client sites (no customer data). Location: US, SCC.
Google LLC
Calendar, Search Console and Business Profile (only when you connect them). Location: US/EU, SCC.
Anthropic PBC
AI answers in chat, support drafts and summaries (only with those modules). Location: US, SCC; no training on your data.
Daily.co / Whereby AS / 8x8 (Jitsi)
Video calls in online consult (the one you choose). Location: US / Norway / US, SCC.
Storecove B.V.
E-invoices via Peppol (only with module peppol). Location: Netherlands.
Trustpilot A/S
Reading reviews (only when you connect it). Location: Denmark.
Not on this list
Public services we only ask a question without personal data (postcode lookup at PDOK/Kadaster, map tiles, VAT check at VIES, licence plate at RDW, flight status) and the accounting package you connect yourself (Moneybird, Exact, e-Boekhouden, SnelStart, Twinfield): that last one is your own processor.
Changes
New sub-processors are announced at least 30 days in advance by email to the owner of each account, with the right to object (see the data processing agreement).