Legal Sub-processor List
Sub-processor List
1. Purpose and how this list works
1.1 This list identifies the sub-processors that SovSec uses, or plans to use, to process personal data on behalf of its business clients (Client Personal Data) under the Data Processing Agreement SOV-LG-003 (the DPA). It forms Annex III of the DPA.
1.2 SovSec's design principle is that Client Personal Data stays in the European Union: all production services SovSec hosts run on dedicated servers in Vienna, Austria, and SovSec does not use US hyperscale cloud providers to host Client Personal Data.
1.3 SovSec as processor. The data controller for Client Personal Data is the client. SovSec Ltd (England and Wales; from 2028 its Austrian subsidiary [SOVSEC FLEXCO NAME] where it has assumed the contract) is the processor. SovSec's own staff access data from the United Kingdom and the EU. That access is covered by the European Commission's adequacy decision for the United Kingdom (renewed December 2025, running to 27 December 2031), with the EU Standard Contractual Clauses as automatic fallback under the DPA.
1.4 A provider is shown as Planned until it begins processing Client Personal Data. SovSec will give 30 days' notice before a planned provider starts, under clause 7 of the DPA, even though it is already listed here.
2. Current and planned sub-processors
Client Personal Processing Transfer
Sub-processor Address / country Service Status
Data location mechanism
netcup GmbH Daimlerstraße 25, 76185 Dedicated servers, All Client Personal Vienna, Not a transfer — Current — data
Karlsruhe, Germany network and data Data held in hosted Austria within the EEA processing
centre services for Services (encrypted agreement
all production at rest; client-held (AVV) signed
Prismara and keys where
SovSec platforms supported)
ESET, spol. s r.o. ESET: Einsteinova 24, Interim endpoint Device and user EU data Not a transfer — Planned — from
or WithSecure 851 01 Bratislava, detection and identifiers, endpoint centres of the within the EEA; service launch
Corporation (one Slovakia · WithSecure: response (EDR) telemetry, alerts, file selected onward transfers (October 2027);
to be selected) Tammasaarenkatu 7, resold within hashes and samples vendor [to per vendor DPA ends when
00180 Helsinki, Finland Secure and confirm] [to confirm] Prismara
Sovereign plans Endpoint
until Prismara replaces it
Endpoint is
generally available
[PARTNER SOC [ADDRESS], EU / EEA 24×7 security Security alerts, EU / EEA Not a transfer — Planned —
NAME] monitoring and telemetry extracts, within the EEA 2028
first-line triage for incident records,
Sovereign plans client contact details
outside SovSec's for escalation
own staffed hours
GitHub, Inc. 88 Colin P. Kelly Jr. Source code No Client Personal USA and EU–US Data Current — to be
Street, San Francisco, hosting and build Data intended. global Privacy replaced by EU-
CA 94107, USA pipelines for SovSec's policy Framework hosted Git
Prismara software forbids putting Client where certified; before general
Personal Data in otherwise SCCs availability
code, issues or logs;
listed for
transparency
Client Personal Processing Transfer
Sub-processor Address / country Service Status
Data location mechanism
Stripe Payments The One Building, 1 Card and wallet Not business Client EEA; Stripe Stripe's own Planned — at
Europe, Ltd. (with Grand Canal Street payments for Personal Data. group mechanisms paid launch of
Stripe Technology Lower, Dublin 2, Ireland Prismara Personal Processes Prismara transfers to (EU–US DPF / Prismara
Europe, Ltd. for Secure Personal subscribers' the USA SCCs) Personal
regulated payment payment data — see Secure
services) note below
Note on Stripe. For Prismara Personal, SovSec is the controller of its subscribers' data, so Stripe is not a sub-processor of any business client. It is shown here for completeness. Stripe acts partly as SovSec's processor and partly as an independent controller (for example for fraud prevention and its regulatory duties as a payment institution). SovSec never sees or stores full card numbers.
Note on the interim EDR vendor. Where a client prefers to contract directly with the EDR vendor, the vendor becomes the client's own processor and is not a SovSec sub-processor for that client.
3. Providers that are not sub-processors
The following providers are used by SovSec or by its clients but do not process Client Personal Data on SovSec's behalf. They are listed so that clients can see why they are excluded.
Provider What it does for SovSec Why it is not a sub-processor
Microsoft (client's own Clients on Microsoft Foundation, Secure and Sovereign plans, and Microsoft contracts directly with the client and is
tenant) Microsoft-based MXDR, keep their data in their own Microsoft 365 / the client's processor. Client data stays in the
Entra ID / Defender / Sentinel tenant. SovSec administers it through client's tenant. SovSec's administration tenant
Granular Delegated Admin Privileges (GDAP) from a dedicated holds only SovSec staff administrator identities,
SovSec administration tenant that is used for nothing else. not Client Personal Data.
Accountants and tax Bookkeeping, statutory accounts, VAT and tax returns for SovSec. They act as independent controllers under
advisers professional duties and receive only SovSec's
([ACCOUNTANT own business records (for example invoices
NAME]) naming client contacts), not Client Personal Data.
Banks and payment Receiving payments from business clients. Independent controllers for payment data under
service providers for financial regulation.
business invoices
Buffer, Inc. (USA) Scheduling SovSec's own social media posts. Processes only SovSec's marketing content and
SovSec staff account data — no client data of any
kind.
Anthropic (Claude) Internal drafting and marketing support. No Client Personal Data is entered. SovSec does
not put Client Personal Data into any third-party
AI tool without the client's prior written instruction
(DPA clause 4.4).
Domain registrars and Registration of SovSec and Prismara domains. Handle only SovSec's own registrant data; email
DNS [REGISTRAR and web traffic for clients is served from SovSec's
NAME] Vienna infrastructure.
4. Change notification and objections
4.1 SovSec will notify clients of any intended addition or replacement of a sub-processor at least 30 days before it starts processing Client Personal Data, by email to each client's nominated privacy or contract contact and by publishing an updated version of this list at sovsec.com/legal. Anyone may ask to be added to the notification list by writing to privacy@sovsec.com.
4.2 Each notice states the sub-processor's name, address, service, the data concerned, the processing location, the transfer mechanism and the start date.
4.3 A client may object on reasonable data protection grounds within the 30-day period. SovSec will discuss the objection in good faith and, if it cannot offer a reasonable alternative, the client may terminate the affected service without early-termination charges, as set out in clause 7.3 of the DPA.
4.4 In an emergency (for example, a sub-processor's insolvency or security failure), SovSec may replace a sub- processor on shorter notice to protect the security or continuity of the service. It will notify clients as soon as reasonably possible, and the objection right runs from that notice.
4.5 Removing a sub-processor, or a change that does not affect Client Personal Data (such as a change of the provider's address), is notified by updating this list; no advance notice is required.
4.6 SovSec carries out due diligence on each sub-processor before engaging it, binds it by a written contract with obligations at least as protective as the DPA, reviews it at least annually, and remains fully liable to clients for its performance.
5. Change history
Version Date Change 1.0 2 November 2026 First published list.
Drafting notes — remove before publication
- Placeholders: [PARTNER SOC NAME] and address, [ACCOUNTANT NAME], [REGISTRAR NAME], [SOVSEC FLEXCO NAME].
- Confirm the EDR vendor choice (ESET or WithSecure), the processing location of its cloud console and any onward transfers before the first client onboarding; remove the vendor not chosen.
- Addresses checked 2 Nov 2026: netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe — netcup legal notice); Stripe Payments UK Ltd (9th Floor, 107 Cheapside, London EC2V 6DN — Companies House); Stripe Technology Europe principal place of business (The One Building, 1 Grand Canal Street Lower, Dublin 2 — Stripe legal page). ESET, WithSecure and GitHub addresses not independently verified — confirm from each vendor's current DPA.
- Confirm whether GitHub, Inc. is currently certified under the EU–US Data Privacy Framework (and UK Extension) when signing; target date for EU-hosted Git migration.
- Confirm Stripe's controller/processor split from Stripe's current Data Processing Agreement and Privacy Policy at paid launch.
- Interim EDR in the EU edition starts October 2027 (EU clients served from then); UK edition April 2027 — align with launch plans.
End of SOV-LG-004 Sub-processor List v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].
1. Purpose and how this list works
1.1 This list identifies the sub-processors that SovSec uses, or plans to use, to process personal data on behalf of its business clients (Client Personal Data) under the Data Processing Agreement SOV-LG-003 (the DPA). It forms Annex III of the DPA.
1.2 SovSec's design principle is that Client Personal Data stays in the European Union: all production services SovSec hosts run on dedicated servers in Vienna, Austria, and SovSec does not use US hyperscale cloud providers to host Client Personal Data.
1.3 SovSec as processor. The data controller for Client Personal Data is the client. SovSec Ltd (England and Wales) is the processor. SovSec's own staff access data from the United Kingdom.
1.4 A provider is shown as Planned until it begins processing Client Personal Data. SovSec will give 30 days' notice before a planned provider starts, under clause 7 of the DPA, even though it is already listed here.
2. Current and planned sub-processors
Processing Transfer
Sub-processor Address / country Service Client Personal Data Status
location mechanism
netcup GmbH Daimlerstraße 25, 76185 Dedicated servers, All Client Personal Vienna, UK adequacy Current — data
Karlsruhe, Germany network and data Data held in hosted Austria regulations (EEA) processing
centre services for Services (encrypted agreement
all production at rest; client-held (AVV) signed
Prismara and keys where
SovSec platforms supported)
ESET, spol. s ESET: Einsteinova 24, Interim endpoint Device and user EU data UK adequacy Planned — from
r.o. or 851 01 Bratislava, detection and identifiers, endpoint centres of the regulations (EEA); service launch
WithSecure Slovakia · WithSecure: response (EDR) telemetry, alerts, file selected onward transfers (April 2027);
Corporation Tammasaarenkatu 7, resold within hashes and samples vendor [to per vendor DPA [to ends when
(one to be 00180 Helsinki, Finland Secure and confirm] confirm] Prismara
selected) Sovereign plans Endpoint
until Prismara replaces it
Endpoint is
generally available
[PARTNER SOC [ADDRESS], EU / EEA 24×7 security Security alerts, EU / EEA UK adequacy Planned —
NAME] monitoring and telemetry extracts, regulations (EEA) 2028
first-line triage for incident records,
Sovereign plans client contact details
outside SovSec's for escalation
own staffed hours
GitHub, Inc. 88 Colin P. Kelly Jr. Source code No Client Personal USA and UK Extension to Current — to be
Street, San Francisco, hosting and build Data intended. global the EU–US Data replaced by EU-
CA 94107, USA pipelines for SovSec's policy Privacy Framework hosted Git
Prismara software forbids putting Client where certified; before general
Personal Data in otherwise IDTA / availability
code, issues or logs; UK Addendum
listed for
transparency
Stripe 9th Floor, 107 Card and wallet Not business Client UK / EEA; Stripe's own Planned — at
Payments UK Cheapside, London payments for Personal Data. Stripe group mechanisms (UK paid launch of
Ltd EC2V 6DN, UK Prismara Personal Processes Prismara transfers to the Extension to the Prismara
Secure Personal subscribers' USA DPF / IDTA) Personal
payment data — see Secure
note below
Note on Stripe. For Prismara Personal, SovSec is the controller of its subscribers' data, so Stripe is not a sub-processor of any business client. It is shown here for completeness. Stripe acts partly as SovSec's processor and partly as an independent controller (for example for fraud prevention and its regulatory duties as a payment institution). SovSec never sees or stores full card numbers.
Note on the interim EDR vendor. Where a client prefers to contract directly with the EDR vendor, the vendor becomes the client's own processor and is not a SovSec sub-processor for that client.
3. Providers that are not sub-processors
The following providers are used by SovSec or by its clients but do not process Client Personal Data on SovSec's behalf. They are listed so that clients can see why they are excluded.
Provider What it does for SovSec Why it is not a sub-processor
Microsoft (client's own Clients on Microsoft Foundation, Secure and Sovereign plans, and Microsoft contracts directly with the client and is
tenant) Microsoft-based MXDR, keep their data in their own Microsoft 365 / the client's processor. Client data stays in the
Entra ID / Defender / Sentinel tenant. SovSec administers it through client's tenant. SovSec's administration tenant
Granular Delegated Admin Privileges (GDAP) from a dedicated holds only SovSec staff administrator identities,
SovSec administration tenant that is used for nothing else. not Client Personal Data.
Accountants and tax Bookkeeping, statutory accounts, VAT and tax returns for SovSec. They act as independent controllers under
advisers professional duties and receive only SovSec's
([ACCOUNTANT own business records (for example invoices
NAME]) naming client contacts), not Client Personal Data.
Banks and payment Receiving payments from business clients. Independent controllers for payment data under
service providers for financial regulation.
business invoices
Buffer, Inc. (USA) Scheduling SovSec's own social media posts. Processes only SovSec's marketing content and
SovSec staff account data — no client data of any
kind.
Anthropic (Claude) Internal drafting and marketing support. No Client Personal Data is entered. SovSec does
not put Client Personal Data into any third-party
AI tool without the client's prior written instruction
(DPA clause 4.4).
Domain registrars and Registration of SovSec and Prismara domains. Handle only SovSec's own registrant data; email
DNS [REGISTRAR and web traffic for clients is served from SovSec's
NAME] Vienna infrastructure.
4. Change notification and objections
4.1 SovSec will notify clients of any intended addition or replacement of a sub-processor at least 30 days before it starts processing Client Personal Data, by email to each client's nominated privacy or contract contact and by publishing an updated version of this list at sovsec.com/legal. Anyone may ask to be added to the notification list by writing to privacy@sovsec.com.
4.2 Each notice states the sub-processor's name, address, service, the data concerned, the processing location, the transfer mechanism and the start date.
4.3 A client may object on reasonable data protection grounds within the 30-day period. SovSec will discuss the objection in good faith and, if it cannot offer a reasonable alternative, the client may terminate the affected service without early-termination charges, as set out in clause 7.3 of the DPA.
4.4 In an emergency (for example, a sub-processor's insolvency or security failure), SovSec may replace a sub- processor on shorter notice to protect the security or continuity of the service. It will notify clients as soon as reasonably possible, and the objection right runs from that notice.
4.5 Removing a sub-processor, or a change that does not affect Client Personal Data (such as a change of the provider's address), is notified by updating this list; no advance notice is required.
4.6 SovSec carries out due diligence on each sub-processor before engaging it, binds it by a written contract with obligations at least as protective as the DPA, reviews it at least annually, and remains fully liable to clients for its performance.
5. Change history
Version Date Change 1.0 2 November 2026 First published list.
Drafting notes — remove before publication
- Placeholders: [PARTNER SOC NAME] and address, [ACCOUNTANT NAME], [REGISTRAR NAME].
- Confirm the EDR vendor choice (ESET or WithSecure), the processing location of its cloud console and any onward transfers before the first client onboarding; remove the vendor not chosen.
- Addresses checked 2 Nov 2026: netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe — netcup legal notice); Stripe Payments UK Ltd (9th Floor, 107 Cheapside, London EC2V 6DN — Companies House); Stripe Technology Europe principal place of business (The One Building, 1 Grand Canal Street Lower, Dublin 2 — Stripe legal page). ESET, WithSecure and GitHub addresses not independently verified — confirm from each vendor's current DPA.
- Confirm whether GitHub, Inc. is currently certified under the EU–US Data Privacy Framework (and UK Extension) when signing; target date for EU-hosted Git migration.
- Confirm Stripe's controller/processor split from Stripe's current Data Processing Agreement and Privacy Policy at paid launch.
- Interim EDR in the EU edition starts October 2027 (EU clients served from then); UK edition April 2027 — align with launch plans.
End of SOV-LG-004 Sub-processor List v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].
Questions about this document? Contact us. SovSec Ltd — Sovereignty is Security.