Sub-processors
This is the complete list of providers we entrust with processing data on behalf of our clients. This page is the authoritative version under Article 28(2) GDPR: Annex 3 of our data processing agreements refers to it and only freezes a snapshot dated on the day of signature.
Version in force as of 12/08/2026
| Sub-processor | Role | Location | Safeguard |
|---|---|---|---|
| Samuel Baudon (SQWR Studio) | Design, technical hosting and operation of the agents on behalf of the Processor | Belgium (Uccle) | Sub-processing agreement under Article 28(4). No transfer |
| Anthropic PBC | Language model: classification, drafting, replies | United States | DPA and standard contractual clauses. No reuse for training, logs deleted within 7 days |
| Supabase | Database and storage of content and metadata | Paris and Ireland, European Union | DPA incorporated into the provider terms. No transfer outside the EU |
| Vercel | Application runtime for the agents | European Union (Paris) since the regional pinning of 12 August 2026, provider global network for page delivery | DPA and standard contractual clauses |
| Composio | Authorised connector to the Controller’s mailbox (email agents only) | United States (Northern Virginia) | Standard contractual clauses |
| Resend | Delivery of service notifications | United States | DPA, standard contractual clauses and EU-US Data Privacy Framework |
| PostHog | Product analytics. No message content | European Union (PostHog Cloud EU) | DPA signed on 12 August 2026. No transfer outside the EU |
| OVH | Outbound campaign mail server (B2B prospecting agents only) | France | DPA. No transfer outside the EU |
| Hetzner | Execution of the scheduled tasks of outbound campaigns (B2B prospecting agents only) | Germany (Gunzenhausen) | Processing agreement no. 187230 of 12 August 2026. No transfer outside the EU |
| GitHub | Code repository and scheduling of planned tasks. No message content | United States | DPA and standard contractual clauses |
| Google Workspace, Meta | Hosting of the Controller’s mailbox or social account, depending on the agent channel | Per the Controller’s own contract | Controller’s own contract, outside the scope of this agreement |
What the list means
Storage of conversations and of the knowledge base is entirely European. Generating the replies, however, involves a model provider established in the United States: that transfer is governed by the European Commission standard contractual clauses, content is never used to train a model, and the provider logs are deleted within seven days.
Not every line concerns every agent. Those marked “email agents” or “B2B prospecting” do not apply to a conversational agent, and vice versa. A client only depends on the providers required by the channels it has activated.
Providers hosting our clients’ mailboxes or social accounts fall under those clients’ own contracts, not ours. They appear here for the transparency of the chain, not as sub-processors we selected.
Change log
Any addition or replacement is published here at least 30 days before it becomes active, and notified by email to clients under contract, who may object on legitimate grounds.
- 12/08/2026
Added Samuel Baudon (SQWR Studio), Hetzner and GitHub. Removed Langfuse, no longer in use. Application runtime pinned to Paris, product analytics moved to PostHog Cloud EU.
Documents available on request
The processing agreements signed with each of these providers, the transfer impact assessment and the detail of the Article 32 security measures are provided to any client under contract who asks for them, as well as to the data protection authority.
For any question about this register, or to exercise your rights: studio@sqwr.be.