Subprocessors
Who processes personal data on our behalf, for what, and where.
Last updated .
1. Current subprocessors
Each provider below processes personal data on our behalf under a data processing agreement that meets Article 28 GDPR. This list is an annex to our Data processing agreement.
| Subprocessor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Microsoft Azure | Hosting: application containers, the PostgreSQL database, blob storage, secrets, logs and backups. | All account and workspace data. | European Union (Azure region Sweden Central). | Data stays in the EU region; Microsoft’s data processing terms for online services apply. |
| Stripe | Payments, invoicing, tax calculation and the billing portal. | Billing contact, company name and address, VAT ID and the payment method. Card numbers never reach Permenta. | European Union and United States. | Stripe’s data processing terms; transfers outside the EU rely on standard contractual clauses or an adequacy decision. |
| Resend | Transactional email: verification, invitations, reporting-deadline reminders and account notices. | Recipient name, email address and the content of the message. | European Union data region; the provider is established in the United States. | Resend’s data processing terms; transfers outside the EU rely on standard contractual clauses or an adequacy decision. |
2. How we add or change a subprocessor
Before we engage a new subprocessor or replace one, we update this page and email the owners of every workspace at least 30 days before the change takes effect. Customers may object on reasonable data protection grounds within that period, as set out in the Data processing agreement. To receive the notices at an additional address, write to privacy@permenta.com.
3. Services that are not subprocessors
- Vulnerability and advisory feeds (OSV, CISA KEV, the EU vulnerability database, EPSS): we download public data from them; no personal data is sent.
- ENISA’s Single Reporting Platform: Permenta prepares notifications but you submit them yourself; nothing is transmitted to ENISA by the Service.
- Sign in with GitHub (optional): if you choose it, GitHub processes your GitHub account data as an independent controller under its own terms; we receive your name, email address and account identifier.