{
  "version": 1,
  "url": "https://shopassist.coec.dk/subprocessors",
  "entries": [
    {
      "id": "hetzner",
      "name": "Hetzner Online GmbH (Germany)",
      "service": "Compute, dedicated database server, object storage, backup repository 1 (separate project), uptime monitoring VM",
      "data": "All service data",
      "locations": [
        "Falkenstein, Germany (service and backups)",
        "Helsinki, Finland (uptime monitoring only, no personal data)"
      ],
      "transfer": "EEA",
      "applies_to": "All plans",
      "since": "2026-10-15"
    },
    {
      "id": "scaleway-tem",
      "name": "Scaleway SAS (France)",
      "service": "Transactional email: transcripts, one-time codes, back-in-stock alerts, double opt-in, action confirmations, merchant notifications",
      "data": "Recipient address, email content",
      "locations": [
        "Paris, France"
      ],
      "transfer": "EEA",
      "applies_to": "All plans",
      "since": "2026-10-15"
    },
    {
      "id": "scaleway-backup",
      "name": "Scaleway SAS (France), Object Storage fr-par",
      "service": "Encrypted backup repository 2",
      "data": "Encrypted database backups",
      "locations": [
        "Paris, France"
      ],
      "transfer": "EEA",
      "applies_to": "All plans",
      "since": "2026-10-15"
    },
    {
      "id": "sentry",
      "name": "Functional Software, Inc. d/b/a Sentry (USA)",
      "service": "Error monitoring in the EU data region (Frankfurt)",
      "data": "Scrubbed error context: pseudonymous ids and request paths. No request bodies, no IP addresses",
      "locations": [
        "Frankfurt, Germany",
        "Some account metadata in the United States"
      ],
      "transfer": "SCCs (Module 3) and the EU–US Data Privacy Framework where certified",
      "applies_to": "All plans",
      "since": "2026-10-15"
    },
    {
      "id": "azure-openai",
      "name": "Microsoft Ireland Operations Ltd (Azure OpenAI, EU Data Zone deployments only)",
      "service": "Managed AI, primary provider",
      "data": "Conversation content and tool results sent for generation",
      "locations": [
        "EU member states"
      ],
      "transfer": "EEA entity (Microsoft DPA including SCCs for any remote access)",
      "applies_to": "Managed AI",
      "since": "2026-10-15"
    },
    {
      "id": "mistral",
      "name": "Mistral AI SAS (France)",
      "service": "Managed AI, fallback provider",
      "data": "Conversation content and tool results sent for generation",
      "locations": [
        "EU"
      ],
      "transfer": "EEA",
      "applies_to": "Managed AI",
      "since": "2026-10-15"
    },
    {
      "id": "vertex-ai",
      "name": "Google Cloud EMEA Ltd (Vertex AI, EU regional or eu multi-region endpoints only; caching and grounding disabled)",
      "service": "Managed AI, second fallback provider",
      "data": "Conversation content and tool results sent for generation",
      "locations": [
        "EU"
      ],
      "transfer": "EEA entity (Google Cloud DPA including SCCs)",
      "applies_to": "Managed AI",
      "since": "2026-10-15"
    }
  ],
  "changes": []
}