Subprocessor List

SUBPROCESSOR LIST — VERSION 1.0 · 15.09.2026 Current production context: the Sympel application, PostgreSQL and Redis are operated in Railway EU West (Amsterdam, Netherlands). PostgreSQL Point-in-Time Recovery and scheduled volume backups are enabled. Provider account, control-plane or support processing may take place outside the selected deployment region. Railway Corporation (USA) Purpose: application/cloud hosting and PostgreSQL/Redis in the current deployment. Production region for the Sympel workloads: EU West (Amsterdam). Railway states in its DPA that primary processing operations may take place in the United States. For transfers from Switzerland, Railway's DPA provides for the Swiss-U.S. Data Privacy Framework where applicable, or adapted EU Standard Contractual Clauses. Plus Five Five, Inc. (Resend, USA) Purpose: transactional and operational email delivery. Processing may include recipient/contact data, email content and metadata, and technical/API data. Resend's DPA incorporates Standard Contractual Clauses for relevant international controller-to-processor and processor-to-subprocessor transfers. Stripe Payments Europe, Limited (Ireland) Purpose: payment, subscription and billing. Before incorporation of GmbH, the current Stripe account is associated with Simone Venneri. For Stripe accounts outside North and South America, Stripe's DPA identifies Stripe Payments Europe, Limited as the DPA contracting party. Stripe's Data Transfers Addendum provides transfer mechanisms including provisions for transfers from Switzerland. KEPTAGO LTD (Geoapify, Cyprus) Purpose: forward/reverse geocoding and administrative-area resolution. Depending on the operation, Sympel sends location information such as country, postal code, city, street, administrative region or coordinates. The current Sympel integration uses the standard api.geoapify.com endpoints; according to Geoapify these use Cloudflare and are not designated as EU-only service processing. Geoapify provides a DPA and documents the subprocessors used for API processing. Cloudflare, Inc. (USA) Purpose: DNS, reverse proxy and edge/security functions for the production Sympel application according to the active production configuration. This may involve processing connection, request and security metadata. Cloudflare's DPA also applies to self-serve agreements and includes provisions for transfers from Switzerland, including Standard Contractual Clauses and other applicable transfer mechanisms. Not listed as third-party subprocessors: Sympel Agent and Sympel Diagnostic Infrastructure/Reflector are Sympel components. Yeastar is generally a customer-selected upstream system/data source; the precise role must be assessed per integration.

Save document