Subprocessors #
Subprocessors are third parties that process personal data on behalf of EthicsPortal when EthicsPortal acts as processor for operator-organizations (controllers). This list is published per Article 28(2) GDPR and the Data Processing Agreement.
Last updated: April 2026.
Current subprocessors #
| Subprocessor | Jurisdiction | Purpose | Data categories |
|---|---|---|---|
 Hetzner Online GmbH | 🇩🇪 Germany (EU) | Server, database hosting, and file attachment storage | All application data: reports, handler identity, messages, audit logs; uploaded attachments (metadata stripped before upload) |
 Cloudflare, Inc. | 🇺🇸 United States | Marketing-site CDN | Marketing-site cached assets |
 Mailjet SAS | 🇫🇷 France (EU) | Transactional email delivery | Handler email addresses, access-code notifications, billing emails |
 Stripe Payments Europe, Ltd | 🇮🇪 Ireland (EU) | Subscription billing and payment processing | Operator billing contact, tokenized payment data |
 Honeybadger Industries, LLC | 🇺🇸 United States | Error tracking (admin and handler side only) | Stack traces, request metadata; reporter IPs are never logged |
 Crisp IM SARL | 🇫🇷 France (EU) | Customer chat for operators (marketing site and handler portal); supports operator identity verification (KYC). See note below on reporter privacy. | Visitor IP, chat content, operator organization name and contact, identity-verification materials |
Whistleblower reporter privacy. Crisp is loaded only on the marketing site and the handler/admin portal. It is not present on the whistleblower reporting portal — the surface where reporters submit and follow up on their reports. No Crisp script, cookie, or identifier reaches reporter-facing pages. Reporters are never tracked by Crisp.
Transfers to jurisdictions outside the EU/EEA rely on Standard Contractual Clauses and additional safeguards as detailed in the Data Processing Agreement.
What counts as a subprocessor #
A subprocessor is any third-party service that processes personal data on behalf of EthicsPortal under a written processing agreement. Services appear here only if they receive, store, or transmit personal data. Internal libraries, package registries, and build-time dependencies are not subprocessors.
Notification of changes #
Operators are notified of additions or changes to this list at least 30 days before a new subprocessor begins processing personal data. Objections to a proposed subprocessor may be raised under the Data Processing Agreement.
Questions #
For questions about subprocessor data-handling, contact support@ethicsportal.eu.
Last updated: