This page lists the sub-processors engaged by Perspective Analytics SAS for the provision of the nocert.io Service, in accordance with Article 28 of the GDPR and the Data Processing Agreement at /legal/dpa. The current version and the version history are maintained below. Paid Customers are individually notified by email and through the platform at least 30 days before the addition or replacement of a sub-processor takes effect. The objection mechanism is described in Section 8 of the DPA.
Hosting and edge infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| OVHcloud SAS (France) | Cloud hosting of Customer Personal Data for nocert-hosted deployments | France and Germany (EEA) | None (EEA) |
| Cloudflare, Inc. (USA) and Cloudflare Ireland Limited (Ireland) | Edge delivery, WAF, and DDoS protection; processes requests and limited technical metadata, but is not the application-data system of record | EEA edge with US headquarters | EU SCCs Module 3 + DPF |
Payment and invoicing
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA) | Payment processing | Ireland (EEA) and USA | EU SCCs Module 2 + DPF |
| Tiime SAS (France) | E-invoicing as a Plateforme Agréée officially certified by DGFiP | France (EEA) | None (EEA) |
Cloud and email infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC / Google Ireland Limited, Google Workspace | Business email (inbound and outbound correspondence, including support) | Ireland (EEA) with US infrastructure | EU SCCs Module 3 + DPF |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc., Amazon EC2, Amazon EKS, and Amazon SES | Supporting compute and managed Kubernetes workloads (Amazon EC2 and Amazon EKS); transactional outbound email delivery (Amazon SES) | EU region (eu-west-1 / eu-central-1) | EU SCCs Module 3 + DPF |
Sub-sub-processors
Each of the sub-processors listed above may itself engage further sub-processors with access to Customer Personal Data. Upon reasonable written request to , nocert provides the list of such further sub-processors to the extent that the information is publicly available or obtainable by nocert under its contract with the relevant sub-processor. This commitment implements EDPB Opinion 22/2024 on the obligations of controllers and processors regarding sub-processors and Section 8 of the Data Processing Agreement.
Version history
July 2026: Hosting locations and infrastructure inventory updated
The OVHcloud hosting location was updated to reflect production infrastructure in France and Germany. The inventory was also corrected to remove an email provider that was not used and to clarify that the existing AWS relationship covers Amazon EC2, Amazon EKS, and Amazon SES. No new sub-processor was added or replaced.
April 2026: Initial list
First publication of the sub-processor list, contemporaneous with the entry into force of the Data Processing Agreement. Initial sub-processors:
- Hosting and edge infrastructure: OVHcloud SAS; Cloudflare, Inc. / Cloudflare Ireland Limited.
- Payment and invoicing: Stripe Payments Europe Ltd. / Stripe, Inc.; Tiime SAS.
- Cloud and email infrastructure: Google LLC / Google Ireland Limited (Google Workspace); Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (Amazon EC2, Amazon EKS, and Amazon SES).
Notifications
Paid Customers receive notifications of any addition or replacement of a sub-processor automatically, by email at the address registered on their account and through the in-platform notification system, at least 30 days before the change takes effect. You may also contact to be added to the sub-processor change notification list.