Sub-processors

Annex C to the Data Processing Agreement (DPA) · list version 1.2 dated 27 October 2026

Status as at 26 October 2026; effective from the date stated on publication at https://cfopanorama.com/legal/sub-processors and in the notice under DPA Article 7.2. This list forms Annex C to the applicable DPA. Current list: https://cfopanorama.com/legal/sub-processors.

Not Sub-processors (no Controller Personal Data): GitHub (source code), domain registrar.

No client AI feature is currently active. A future feature may use models including Anthropic Claude through Google Vertex AI with an EU endpoint. Before activation, the Processor will notify the specific providers, data flow and scope, processing location, retention and transfer safeguards and obtain the Controller’s express documented instruction under Article 7.5. An EU endpoint alone does not guarantee EU-only processing. Controller data will not be used to train models. Staff use general-purpose AI tools only with fictitious or demo data.

The Processor recommends sending accounting data only by uploading it to the Service, not by email.

Applicable supplier terms and limitations: Google Cloud notifies incidents without undue delay and primarily supports audits through reports; this does not release the Processor from Articles 11 and 12. Automatic Service database backups are retained for 7 days. Residual Google copies may be physically erased in the standard cycle up to 180 days from initiation of the relevant deletion at Google. Resend also processes data in the USA; EU sending must actually be configured. Microsoft’s EU Data Boundary has exceptions, including certain support access and security processing. Resend notifies personal data breaches without undue delay (Resend DPA clause 8.6); its clause 8.8 excludes notification for breaches resulting from the customer's acts or omissions, but the standard contractual clauses prevail under Resend DPA clause 10.1 and the Processor is not released from Article 11. Resend gives 14 days' notice of changes to its own sub-processors; towards the Controller the periods of Article 7 apply.
Specific retention periods: Resend – message content and delivery records for the period configured in the Processor's Resend account (a limited number of days) and in any event deleted no later than 90 days after termination of the account (Resend DPA, Exhibit A); Microsoft 365 – deleted messages are recoverable for 14 days and are then removed by Microsoft within its cycle (at most 30 days); the support mailboxes are not under hold or archiving. Active support working copies are deleted when no longer needed; minimal correspondence about a closed request within 90 days at the latest, subject to Article 14.5 exceptions.
DPF may be used only where the relevant recipient has valid certification covering the transfer; otherwise applicable standard contractual clauses must be in place before transfer, with necessary assessment and supplementary measures under Article 8. The Processor verifies the applicable mechanism. Disclosing differences does not cure a supplier contract’s failure to comply with Article 28 GDPR or restrict liability under Article 7.6. Changes follow Article 7, not automatically a supplier’s shorter period.