Vendors
One datasheet per vendor: who legally operates it, where the data sits, who else touches it, what it is certified for, how long it is supported.
| Vendor | Category | HQ | EU data location | Subprocessors | Certifications |
|---|---|---|---|---|---|
| 1Password | Password manager | CA | Terms not stated | not read | 5 |
| 3DS Outscale | Cloud infrastructure | FR | Terms not stated | not read | 6 |
| AWS European Sovereign Cloud | Cloud infrastructure | LU | Terms not stated | not read | 10 |
| ActiveCampaign | Email marketing | US | EU by default | 8 | 3 |
| Adobe | Design | US | Terms not stated | 57 | 19 |
| Adyen | Payments | NL | Not stated | 4 | 2 |
| Aircall | Telephony | — | EU by default | 24 | 5 |
| Airtable | Work management | US | Not stated | 23 | 10 |
| Amazon Web Services | Cloud infrastructure | US | Terms not stated | 16 | 30 |
| Amplitude | Analytics | US | Terms not stated | 9 | 2 |
| Anthropic | AI API | US | No EU location | 22 | 4 |
| Apollo.io | Sales intelligence | — | Not stated | 23 | 8 |
| Asana | Work management | US | Paid upgrade | 23 | 11 |
| Atlassian | Work management | AU | Paid upgrade | 32 | 15 |
| Attio | CRM marketing | GB | Not stated | 14 | 4 |
| Backblaze | Cloud infrastructure | US | Not stated | 31 | 10 |
| Bitwarden | Password manager | — | Terms not stated | 20 | 8 |
| Bleu | Cloud infrastructure | FR | EU by default | not read | 2 |
| Box | File storage | US | Terms not stated | 9 | 15 |
| Brevo | Email marketing | FR | EU by default | 23 | 4 |
| Calendly | Scheduling | US | Not stated | 20 | 5 |
| Canva | Design | AU | Enterprise only | 15 | 7 |
| Cisco Webex | Video conferencing | US | EU by default | not read | 2 |
| Clay | Sales intelligence | — | Not stated | 33 | 5 |
| CleverReach | Email marketing | DE | EU by default | 3 | not read |
| ClickHouse | Database | US | Not stated | 12 | 8 |
| ClickUp | Work management | US | Enterprise only | 53 | 12 |
| Cloudflare | CDN edge | US | Enterprise only | 12 | 20 |
| Contentsquare | Analytics | FR | Terms not stated | 30 | 8 |
| CookieYes | Consent management | GB | Not stated | 21 | not read |
| CrowdStrike | Security | US | Not stated | not read | 17 |
| Cursor | AI tools | US | Not stated | 20 | 4 |
| DATEV | Accounting | DE | Not stated | not read | 5 |
| Databricks | Data warehouse | US | Terms not stated | 11 | 21 |
| Datadog | Observability | US | Terms not stated | 18 | 20 |
| DeepL | Translation | DE | Enterprise only | not read | 5 |
| Deepgram | AI API | US | Terms not stated | 45 | 1 |
| Delos Cloud | Cloud infrastructure | DE | EU by default | not read | 1 |
| DigitalOcean | Cloud infrastructure | US | Terms not stated | 30 | 5 |
| Discord | Messaging | US | Not stated | not read | not read |
| Docker | Developer platform | US | Not stated | 8 | 9 |
| Docusign | E signature | US | EU by default | not read | 6 |
| Doodle | Scheduling | CH | EU by default | 13 | 4 |
| Drata | Compliance | US | Not stated | 51 | 10 |
| Dropbox | File storage | US | Paid upgrade | 11 | 16 |
| Elastic Cloud | Observability | — | Terms not stated | 17 | 13 |
| Element | Messaging | GB | Not stated | 6 | 4 |
| ElevenLabs | AI API | US | Enterprise only | 3 | 21 |
| Eventbrite | Event management | US | Not stated | 22 | 1 |
| Figma | Design | US | Enterprise only | 48 | 12 |
| Freshworks | Customer support | US | Not stated | 20 | 11 |
| GitHub | Developer platform | US | Enterprise only | 24 | 9 |
| GitLab | Developer platform | US | Enterprise only | 49 | 7 |
| Gong | Sales intelligence | — | Terms not stated | 7 | 13 |
| Google Analytics | Analytics | IE | Not stated | 52 | 1 |
| Google Cloud | Cloud infrastructure | US | No extra charge | 37 | 11 |
| Google Workspace | Productivity suite | US | Paid upgrade | 61 | 9 |
| Grafana Labs | Observability | US | Terms not stated | 8 | 5 |
| Grammarly | AI tools | US | Not stated | 20 | 9 |
| Granola | AI tools | US | No EU location | 17 | 2 |
| Hetzner | Cloud infrastructure | DE | EU by default | 3 | 1 |
| Hostinger | Hosting PaaS | CY | Not stated | 8 | 3 |
| HubSpot | CRM marketing | US | Paid upgrade | 17 | 3 |
| IONOS Cloud | Cloud infrastructure | DE | Terms not stated | not read | 4 |
| Infomaniak | Productivity suite | CH | No EU location | not read | 3 |
| Intercom | Customer messaging | US | Enterprise only | 16 | 7 |
| JetBrains | Developer platform | CZ | EU by default | 16 | 2 |
| Jotform | Forms surveys | GB | Terms not stated | 7 | 8 |
| Kahoot! | Forms surveys | NO | Not stated | 13 | 2 |
| Klaviyo | Email marketing | — | Terms not stated | 26 | 2 |
| KnowBe4 | Security | US | Terms not stated | 23 | 13 |
| Langdock | AI tools | DE | EU by default | 7 | 3 |
| Langfuse | Observability | US | Not stated | 8 | not read |
| Linear | Work management | — | Terms not stated | 34 | not read |
| Lovable | AI tools | US | Terms not stated | 46 | 5 |
| Lusha | Sales intelligence | — | Not stated | 27 | 8 |
| Mailchimp | Email marketing | US | Not stated | 25 | 5 |
| Mailgun | Communications API | US | Terms not stated | 65 | 3 |
| Make | Automation | US | Terms not stated | 18 | 4 |
| Mapbox | Developer platform | — | No EU location | 15 | 4 |
| Matomo Cloud | Analytics | NZ | EU by default | 3 | not read |
| Mentimeter | Forms surveys | SE | EU by default | 10 | 2 |
| Microsoft | Productivity suite | US | Terms not stated | 2 | 32 |
| Miro | Work management | US | EU by default | 14 | 10 |
| Mistral AI | AI API | FR | EU by default | 23 | 3 |
| Mixpanel | Analytics | US | Terms not stated | 9 | 5 |
| Mollie | Payments | NL | Not stated | not read | 3 |
| MongoDB | Database | US | Terms not stated | not read | 19 |
| Mural | Work management | US | Not stated | 14 | 7 |
| Netlify | Hosting PaaS | US | Not stated | 26 | 9 |
| New Relic | Observability | US | Terms not stated | 16 | 8 |
| Nextcloud | File storage | DE | Not stated | not read | 2 |
| Notion | Work management | US | Enterprise only | 32 | 11 |
| OVHcloud | Cloud infrastructure | FR | Terms not stated | not read | 11 |
| Okta | Identity | US | Terms not stated | 23 | 23 |
| OneTrust | Consent management | — | No extra charge | 15 | 11 |
| OpenAI | AI API | US | Paid upgrade | 16 | 14 |
| OpenRouter | AI API | US | Paid upgrade | 19 | 1 |
| Optimizely | Analytics | US | Not stated | 31 | 10 |
| Oracle Cloud | Cloud infrastructure | — | Terms not stated | not read | 27 |
| PayPal | Payments | LU | Not stated | not read | 1 |
| Pennylane | Accounting | FR | EU by default | 30 | 2 |
| Perplexity | AI API | — | Not stated | 22 | 6 |
| Personio | Hr | — | Not stated | not read | 3 |
| Pipedrive | CRM marketing | US | EU by default | 19 | 8 |
| Piwik PRO | Analytics | PL | Terms not stated | 4 | 5 |
| Pleo | Spend management | DK | EU by default | 24 | 4 |
| PostHog | Analytics | US | Terms not stated | 4 | 5 |
| Postmark (ActiveCampaign) | Communications API | — | No EU location | 5 | not read |
| Proton | Productivity suite | CH | Not stated | 11 | 2 |
| Qualtrics | Experience management | US | Not stated | 88 | 11 |
| Retool | Developer platform | US | Not stated | 11 | 4 |
| Rippling | Hr | — | Not stated | not read | 7 |
| S3NS | Cloud infrastructure | FR | Terms not stated | not read | 3 |
| SAP | Erp | — | Not stated | not read | not read |
| STACKIT | Cloud infrastructure | DE | EU by default | not read | 9 |
| STRATO | Cloud infrastructure | DE | EU by default | 14 | 2 |
| Salesforce | CRM marketing | — | Not stated | not read | 5 |
| Scaleway | Cloud infrastructure | FR | Terms not stated | 11 | 3 |
| Sentry | Error tracking | US | Terms not stated | 8 | 6 |
| Shopify | Ecommerce | CA | EU by default | 14 | 2 |
| Sinch | Communications API | — | EU by default | 65 | 6 |
| SiteGround | Hosting PaaS | GB | Terms not stated | not read | not read |
| Slack | Messaging | US | Paid upgrade | not read | 19 |
| Smartsheet | Work management | US | Terms not stated | 44 | 7 |
| Snowflake | Data warehouse | US | Terms not stated | not read | 15 |
| Spendesk | Spend management | FR | EU by default | 21 | 2 |
| Squarespace | Website builder | US | Not stated | not read | 1 |
| Stripe | Payments | US | Not stated | 45 | 8 |
| Supabase | Database | SG | Terms not stated | 23 | 4 |
| SurveyMonkey | Forms surveys | US | Terms not stated | 20 | 10 |
| T Cloud Public | Cloud infrastructure | DE | Terms not stated | 3 | 9 |
| TeamViewer | Remote access | DE | Not stated | not read | 8 |
| Telegram | Messaging | VG | EU by default | not read | not read |
| Tresorit | File storage | CH | EU by default | 7 | 4 |
| Twilio | Communications API | US | Terms not stated | 32 | 8 |
| Typeform | Forms surveys | ES | Enterprise only | 26 | 11 |
| Usercentrics | Consent management | DE | EU by default | 5 | 11 |
| Vanta | Compliance | US | Terms not stated | 38 | 3 |
| Vercel | Hosting PaaS | US | Not stated | 34 | 16 |
| Vimeo | Video hosting | US | Not stated | 30 | 8 |
| Vonage | Communications API | US | Not stated | not read | 5 |
| WeTransfer | File transfer | NL | Not stated | 17 | 4 |
| Webflow | Website builder | US | Not stated | 37 | 7 |
| WhatsApp Business | Communications API | US | Terms not stated | not read | 2 |
| Wire | Messaging | CH | EU by default | 11 | 3 |
| Wix | Website builder | IL | Not stated | 15 | 5 |
| WordPress.com | Website builder | US | No EU location | 5 | not read |
| Workday | Hr | US | Not stated | not read | 21 |
| Xero | Accounting | NZ | Not stated | 21 | 3 |
| Zapier | Automation | US | No EU location | 33 | 4 |
| Zendesk | Customer support | US | Paid upgrade | 33 | 16 |
| Zoho | CRM marketing | SG | Terms not stated | 42 | 18 |
| Zoom | Video conferencing | US | Paid upgrade | 22 | 20 |
| ZoomInfo | Sales intelligence | US | Not stated | 29 | 6 |
| Zscaler | Security | US | Not stated | 19 | 21 |
| iubenda | Consent management | IT | Not stated | not read | 2 |
| monday.com | Work management | IL | Paid upgrade | 27 | 10 |
| n8n | Automation | DE | EU by default | 17 | 3 |
| netcup | Cloud infrastructure | DE | Not stated | not read | 4 |
A number here is a count of what we transcribed, not a claim about what the vendor has. Where we hold no readable source, the cell says not read rather than nought — a nought would assert that a vendor has no subprocessors or no certifications, which is a very different statement from ours. Open the vendor to see which document was gated, blocked, or never published.