This register identifies service providers used or authorised for NoCert and their roles. Infrastructure and delivery providers process Customer Personal Data on instructions where applicable. Payment, invoicing and account-support providers may instead process data for NoCert’s own controller purposes or their own legal duties; listing them does not convert all processing into sub-processing under this DPA. All affected Customers, including Free and Trial, receive advance notice of additions or replacements under Section 8 of the DPA.
Hosting and edge infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| OVHcloud SAS (France) | Cloud hosting of Customer Personal Data for nocert-hosted deployments | France and Germany (EEA) | None (EEA) |
| Scaleway SAS (France) | Transient compute for outbound relays (public TLS scanning and alert delivery); processes data in transit only and stores no Customer Personal Data | European Union (EEA) | None (EEA) |
| Cloudflare, Inc. (USA) and Cloudflare Ireland Limited (Ireland) | Edge delivery, WAF, and DDoS protection; processes requests and limited technical metadata, but is not the application-data system of record | Global edge network; US and EEA entities. No EU-only edge processing commitment. | Applicable provider DPA; Article 45 adequacy where valid and covering the recipient/service, otherwise Article 46 safeguards and the required assessment. |
Payment and invoicing
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA) | Payment processing | Ireland (EEA) and USA | EU SCCs Module 2 + DPF |
| Tiime SAS (France) | E-invoicing as a Plateforme Agréée officially certified by DGFiP | France (EEA) | None (EEA) |
Cloud and email infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC / Google Ireland Limited, Google Workspace | Business and support email; current application SMTP provider for sign-in codes, monitoring alerts, account notices and optional messages. Processes recipient addresses and contents, which may include customer infrastructure details. | Global provider infrastructure; no EU-only email processing commitment. | Applicable provider DPA; Article 45 adequacy where valid and covering the recipient/service, otherwise Article 46 safeguards and the required assessment. |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc., Amazon SES | Additional transactional email provider when enabled, subject to the DPA and transfer safeguards. Google Workspace is the current default. | EU region required for NoCert activation; international support or sub-processor access remains subject to transfer safeguards. | Applicable provider DPA; Article 45 adequacy where valid and covering the recipient/service, otherwise Article 46 safeguards and the required assessment. |
Sub-sub-processors
Each of the sub-processors listed above may itself engage further sub-processors with access to Customer Personal Data. Upon reasonable written request to , nocert provides the list of such further sub-processors to the extent that the information is publicly available or obtainable by nocert under its contract with the relevant sub-processor. This commitment implements EDPB Opinion 22/2024 on the obligations of controllers and processors regarding sub-processors and Section 8 of the Data Processing Agreement.
Notifications
All affected Customers, including Free and Trial, receive a direct notice at least 30 days before a planned provider addition or replacement, under Section 8 of the DPA. These necessary data-protection notices are separate from optional setup emails and monthly summaries. Unsubscribing from optional messages does not disable these notices.