Sub-processors

• Supabase, Inc.. Database, sign-in and file storage: workspaces, people, signatures, images, activity log. Location: Frankfurt, Germany (EU). Daily backups stay in the EU.
• Cloudflare, Inc.. Runs the application and the Outlook add-in endpoints, delivers invitation and signature emails, keeps technical request logs for at most 7 days. Location: Global network; requests are handled at the location nearest the visitor. Stored data stays with Supabase in the EU.
• Stripe Payments Europe, Ltd.. Payments for paid packages: the billing contact, company details and payment method of the workspace owner. Location: Ireland (EU), with Stripe group companies.

Microsoft 365 is not our sub-processor: your company uses it under its own agreement with Microsoft. MonaSign relies on it for signing in with Microsoft, verifying domains, the Outlook add-in and, when your company chooses it, reading your users, with their departments, as the company's people. Microsoft tells MonaSign who is signed in; signatures are inserted inside your own Outlook.

Stored data stays in the EU. Supabase, Cloudflare and Stripe are part of groups based in the United States; where personal data reaches them outside the EU, the transfer is covered by the EU Standard Contractual Clauses in their data processing terms and, where they are certified, by the EU-US Data Privacy Framework.

Before we add or replace a sub-processor we update this page and email the owner of every workspace at least 30 days in advance. If your company objects on reasonable data protection grounds, tell us at hello@weedoo.work; if we cannot address the objection, your company may end its subscription and have its workspace deleted, as set out in the data processing agreement.