Sub-processors
Current as of 2026-08-19
The table below lists every third-party processor we use to deliver the Digital Worker platform. Each entry shows the categories of personal data they may access, their location, and the lawful transfer mechanism for any processing outside the European Economic Area (EEA).
We notify customers under our Data Processing Agreement in advance of any addition or replacement, and customers may object on reasonable data-protection grounds.
Core sub-processors (always on)
| Provider | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
|
Hostinger Hostinger International Ltd. |
VPS hosting (single-tenant) — current provider | All platform data at rest and in transit on our server | Frankfurt, Germany (EU) | Within EU, no third-country transfer |
|
netcup netcup GmbH, and the Anexia group entities it engages: Anexia Holding GmbH (Klagenfurt, AT); Anexia Cloud Solutions GmbH (Klagenfurt, AT); Anexia Cloud Solutions GmbH (Karlsruhe, DE) |
Root server hosting (single-tenant), snapshots — incoming provider, replacing Hostinger | All platform data at rest and in transit on our server | Nuremberg, Germany (EU); Vienna (AT) | Within EU, no third-country transfer |
|
OpenAI OpenAI Ireland Ltd. (our contracting entity in the EEA) |
LLM inference, embeddings, transcription, Realtime voice | Whatever the user types into agents that use OpenAI models (chat text, voice transcript, uploaded files, tool-call payloads) | Ireland (EU) with onward transfer to US | Art. 28 data processing addendum with OpenAI Ireland Ltd.; onward intra-group transfer to the US under OpenAI's SCC-based intra-group agreements. API data is retained by OpenAI for a maximum of 30 days and is not used to train their models. |
|
Anthropic Anthropic, PBC. |
LLM inference (Claude model family), Claude Agent SDK | Whatever the user types into agents that use Anthropic models | United States | EU Standard Contractual Clauses (2021/914) |
|
Mailgun Mailgun Technologies, Inc. (a Sinch company) — EU region |
Transactional email (password reset, notifications, invoices) | Email address, name, transactional content | EU region (Frankfurt, Germany) | Processing in Mailgun's EU region; EU Standard Contractual Clauses cover access by its US parent |
Change of hosting provider (in progress). netcup GmbH will replace Hostinger International Ltd. as our hosting sub-processor. Until the migration completes, customer data remains with Hostinger in Frankfurt and both providers are listed above. Existing customers receive the 30 days advance notice required by the DPA before any instance is migrated, and no customer data moves before that notice period has run. This page is updated on cutover.
Optional sub-processors (engaged only when you use the feature)
| Provider | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
|
Google Google Ireland Ltd. |
OAuth sign-in (only if the user chooses "Sign in with Google") | Profile name, email, profile image, Google account ID | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; user-initiated transfer at sign-in |
|
Meta Meta Platforms Ireland Ltd. |
WhatsApp Business Platform — only when you connect a WhatsApp number to an agent (Klikeri / direct Cloud API) | Phone number, conversation content, media attachments | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; Meta's WhatsApp Business Terms |
|
Infobip Infobip Ltd. |
WhatsApp / SMS BSP — only when you connect an Infobip-routed channel | Phone number, conversation content, delivery metadata | Croatia / United Kingdom (EU + UK adequacy) | Within EU/UK adequacy; no third-country transfer |
|
Twilio Twilio Ireland Ltd. |
SMS / voice — only when you connect a Twilio channel | Phone number, conversation content | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses |
|
Stripe Stripe Payments Europe Ltd. |
Subscription billing (only paid customers) | Billing name, email, VAT ID, payment-method identifier (no full card data — held by Stripe) | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; PCI-DSS compliant |
Self-hosted services (not sub-processors)
The following components run inside the same hosting boundary as the Digital Worker application and are operated by Apex Academy d.o.o., not by a third party:
- MySQL — primary application database
- Redis — session store, rate limiting, job queue
- Qdrant — vector database for retrieval- augmented generation
Notifications and objections
Material changes to this list are announced to the email address on file for each customer's primary admin — at least 30 days in advance where the change is within our control, and otherwise as soon as practicable after the provider concerned notifies us. Some upstream providers give us shorter notice than 30 days of their own sub-processor changes, and we pass those on immediately. To object to a new sub-processor or to be notified outside the email channel, contact privacy@apexacademy.hr.