This page lists the sub-processors engaged by Perspective Analytics SAS for the provision of the nocert.io Service, in accordance with Article 28 of the GDPR and the Data Processing Agreement at /legal/dpa. Paid Customers are individually notified by email at least 30 days before the addition or replacement of a sub-processor takes effect. The objection mechanism is described in Section 8 of the DPA.
Hosting and edge infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| OVHcloud SAS (France) | Cloud hosting of Customer Personal Data for nocert-hosted deployments | France and Germany (EEA) | None (EEA) |
| Scaleway SAS (France) | Transient compute for outbound relays (public TLS scanning and alert delivery); processes data in transit only and stores no Customer Personal Data | European Union (EEA) | None (EEA) |
| Cloudflare, Inc. (USA) and Cloudflare Ireland Limited (Ireland) | Edge delivery, WAF, and DDoS protection; processes requests and limited technical metadata, but is not the application-data system of record | EEA edge with US headquarters | EU SCCs Module 3 + DPF |
Payment and invoicing
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA) | Payment processing | Ireland (EEA) and USA | EU SCCs Module 2 + DPF |
| Tiime SAS (France) | E-invoicing as a Plateforme Agréée officially certified by DGFiP | France (EEA) | None (EEA) |
Cloud and email infrastructure
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC / Google Ireland Limited, Google Workspace | Business email (inbound and outbound correspondence, including support) | Ireland (EEA) with US infrastructure | EU SCCs Module 3 + DPF |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc., Amazon EC2, Amazon EKS, and Amazon SES | Supporting compute and managed Kubernetes workloads (Amazon EC2 and Amazon EKS); transactional outbound email delivery (Amazon SES) | EU region (eu-west-1 / eu-central-1) | EU SCCs Module 3 + DPF |
Sub-sub-processors
Each of the sub-processors listed above may itself engage further sub-processors with access to Customer Personal Data. Upon reasonable written request to , nocert provides the list of such further sub-processors to the extent that the information is publicly available or obtainable by nocert under its contract with the relevant sub-processor. This commitment implements EDPB Opinion 22/2024 on the obligations of controllers and processors regarding sub-processors and Section 8 of the Data Processing Agreement.
Notifications
Paid Customers receive notifications of any addition or replacement of a sub-processor automatically, by email at the address registered on their account, at least 30 days before the change takes effect. You may also contact to be added to the sub-processor change notification list.