Sub-processors

Annex C to the Data Processing Agreement (DPA) · list version 1.4 dated 9 November 2026

Status as at 9 November 2026; effective from the date stated on publication at https://cfopanorama.com/legal/sub-processors and in the notice under DPA Article 7.2. This list forms Annex C to the applicable DPA. Current list: https://cfopanorama.com/legal/sub-processors.

Optional sub-processors (only where the Controller has accepted AIC 2.0 Part E)

This sub-processor processes Controller Personal Data only for a Controller that has accepted Part E ("Claude by Anthropic") of the AI features addendum AIC 2.0, and only while that Part is accepted. For every other Controller it is not a sub-processor.

Not Sub-processors (no Controller Personal Data): GitHub (source code), domain registrar.

Client AI features (where the Controller has accepted the AI features addendum AIC 2.0, Part D): the platform-side assistant, the AI account-mapping assistant, the spreadsheet analyst and the Boardroom's answers use Google Cloud's Vertex AI models (including Anthropic Claude served by Google and Google Gemini) in an EU region only (unless the Controller has accepted Part E, below), under the Google Cloud Data Processing Addendum already listed above — an extension of Google's purpose, not a new sub-processor. Data flow: the question and the report figures, account names and clipped posting texts the tools return for that request; no training or fine-tuning on Controller data; nothing is retained by the model provider beyond the request under its terms. An EU endpoint alone does not guarantee EU-only processing of support or abuse-monitoring metadata. The Controller may object within 30 days under Article 7.2; the features stay off for a Controller that has not accepted Part D. Staff use general-purpose AI tools only with fictitious or demo data.

The Processor recommends sending accounting data only by uploading it to the Service, not by email.

Applicable supplier terms and limitations: Google Cloud notifies incidents without undue delay and primarily supports audits through reports; this does not release the Processor from Articles 11 and 12. Automatic Service database backups are retained for 7 days. Residual Google copies may be physically erased in the standard cycle up to 180 days from initiation of the relevant deletion at Google. Resend also processes data in the USA; EU sending must actually be configured. Microsoft’s EU Data Boundary has exceptions, including certain support access and security processing. Resend notifies personal data breaches without undue delay (Resend DPA clause 8.6); its clause 8.8 excludes notification for breaches resulting from the customer's acts or omissions, but the standard contractual clauses prevail under Resend DPA clause 10.1 and the Processor is not released from Article 11. Resend gives 14 days' notice of changes to its own sub-processors; towards the Controller the periods of Article 7 apply.
Specific retention periods: Resend – message content and delivery records for the period configured in the Processor's Resend account (a limited number of days) and in any event deleted no later than 90 days after termination of the account (Resend DPA, Exhibit A); Microsoft 365 – deleted messages are recoverable for 14 days and are then removed by Microsoft within its cycle (at most 30 days); the support mailboxes are not under hold or archiving. Active support working copies are deleted when no longer needed; minimal correspondence about a closed request within 90 days at the latest, subject to Article 14.5 exceptions.
DPF may be used only where the relevant recipient has valid certification covering the transfer; otherwise applicable standard contractual clauses must be in place before transfer, with necessary assessment and supplementary measures under Article 8. The Processor verifies the applicable mechanism. Disclosing differences does not cure a supplier contract’s failure to comply with Article 28 GDPR or restrict liability under Article 7.6. Changes follow Article 7, not automatically a supplier’s shorter period.