Sub-processors
Public and up-to-date list of providers that may access personal data processed by EcomVerify.
Public and up-to-date list of providers that may access personal data processed by EcomVerify.
Pursuant to GDPR Art. 28.2 and the Amazon Data Protection Policy, we publish the list of sub-processors. Any change will be notified with reasonable advance notice so clients may object.
| Provider | Location | Purpose | Data categories | Safeguards |
|---|---|---|---|---|
| OVHcloud / Hetzner (hosting) | European Union (Germany/France) | Servers, databases and backup hosting | All Service data | Signed DPA, encryption at rest, EU location |
| Cloudflare, Inc. (CDN / WAF) | Global (EU routing preferred) | DDoS protection, WAF, CDN, TLS termination | Traffic metadata, access logs | DPA, EU SCCs, ISO 27001 |
| Amazon Web Services (SES / S3) | EU (eu-west-1 / eu-central-1) | Email delivery and backup storage | Operational emails and logs | DPA, SCCs, ISO 27001, SOC 2 |
| Software DELSOL, S.A. (ContaSol) | Spain | External accounting integration chosen by the client | Invoices, journal entries, third parties | Spanish provider under LOPDGDD |
| Google Ireland Ltd. (analítica, opt-in) | EU (Ireland) | Aggregated web analytics (consent-based) | Anonymous navigation events | DPA, SCCs, explicit opt-in |
Last updated: 2026-08-03.