Sub-processors
This is a translation for convenience. The binding version of this document is the Spanish one: the Spanish version. In case of discrepancy, the Spanish text prevails.
Third parties that may process personal data on Aseptic's behalf. Article 28(2) GDPR requires notice of additions and changes: they are announced 30 days in advance and the Customer may object.
| Sub-processor | What for | Data | Location | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. USA |
Team catalogue storage, usage records, quota counter and running the service | End-to-end encrypted scenarios; metadata in the clear; usage records | EU: storage under European jurisdiction and database in Western Europe | Standard Contractual Clauses + EU-US Data Privacy Framework |
| Functional Software, Inc. (Sentry) USA |
Error diagnostics | Exception traces, version, operating system, installation identifier, IP | EU (Germany) | Standard Contractual Clauses + Data Privacy Framework |
| Kinde Inc. Australia / USA |
Authentication and identity | Email, name, account identifier, organisation | See their documentation | Standard Contractual Clauses |
What is NOT a sub-processor
Paddle.com Market Ltd. It is the Merchant of Record: it does not process data on our behalf, it sells. Towards the buyer it is the seller, issues their invoice and settles their taxes, and handles their payment data as an independent controller, under its own privacy policy. It is not a sub-processor: subcontracting it would mean it processes data on our instructions, which it does not. It sits in the United Kingdom, covered by the European Commission's adequacy decision.
The copilot's AI provider. The user picks their own (Anthropic, OpenAI, Google, a local model…) and uses their own key: the conversation goes from their machine to the provider without passing through Aseptic. We neither broker nor store it, so it is not a sub-processor of ours but processing of the user's own, governed by whatever contract they have with that provider.
This is stated explicitly because it is the question every security department asks on seeing the word “copilot”, and the right answer changes who is accountable for what.
Change history
| Date | Change |
|---|---|
| 2026-07-28 | Initial document. Cloudflare added as sub-processor for the team catalogue (Team plan, hosted option). |