Legal
Subprocessors and Data Locations
Last updated: 7 September 2026
1. About this list
This page identifies material service providers that may process personal data to support CyfroSec’s website or services. Whether a provider processes a particular customer’s Customer Personal Data depends on the selected services, deployment model, configuration and Order Form.
CyfroSec remains responsible for its processors to the extent required by the applicable Data Processing Addendum and data-protection law. Providers are subject to written data-protection and confidentiality obligations appropriate to their role.
2. Customer-service subprocessors
Amazon Web Services EMEA SARL / Amazon Web Services group
Purpose: cloud infrastructure, storage, networking, logging, backup and related hosting services.
Primary location: European Union, including the AWS Europe (Frankfurt) region where selected.
Transfer position: data may be accessed or processed by authorised group entities or support providers outside the EEA where necessary, subject to an applicable adequacy decision, Standard Contractual Clauses and supplementary safeguards.
OVHcloud contracting entity applicable to the customer deployment
Purpose: optional European cloud infrastructure and hosting where selected in the Order Form.
Primary location: Poland or another agreed European location.
Transfer position: according to the applicable service configuration and contractual safeguards.
OpenAI Ireland Ltd. and its authorised subprocessors
Purpose: external generative-AI processing for enabled CyfroAI Insights, CyfroAssistant, CyfroCode or related features.
Data: prompts, selected messages, documents, repository content, findings or other limited information submitted to the enabled function.
Primary contracting and processing position: OpenAI Ireland Ltd. for EEA customers; processing may involve authorised affiliates and subprocessors in other locations.
Transfer position: adequacy decisions, Standard Contractual Clauses and other safeguards described in the applicable OpenAI data-processing terms.
Retention position: API data is not used to train or improve OpenAI models by default unless the API organisation opts in. Supported Responses API calls are configured with response storage disabled. Content may nevertheless be retained in abuse-monitoring logs for up to 30 days by default, subject to provider controls and legal or safety exceptions.
3. Website and business-operation providers
Vercel Inc. and authorised service providers
Purpose: hosting, content delivery, performance and security of the public CyfroSec website.
Location: EEA, United States and other infrastructure locations used to deliver the website.
Transfer position: applicable adequacy mechanisms, Standard Contractual Clauses and supplementary safeguards.
Metricool Software, S.L. and authorised service providers
Purpose: website analytics, performance measurement and marketing attribution where enabled.
Location: Spain/EEA and locations used by authorised service providers.
Activation: Metricool is treated as non-essential and is activated only after valid consent where required.
Transfer position: applicable adequacy mechanisms or Standard Contractual Clauses where personal data is transferred outside the EEA.
Website and business-operation providers do not necessarily process Customer Personal Data submitted to the CyfroSec platform. Their role is limited to the relevant website or business operation unless separately identified in a customer agreement.
4. Changes and objections
CyfroSec may add or replace a subprocessor where necessary to provide the services. Where the applicable DPA requires advance notice, CyfroSec will provide notice through email, an account notification or another agreed channel before the new subprocessor begins processing Customer Personal Data.
A customer may object within the period stated in its DPA by contacting privacy@cyfrosec.com and providing reasonable data-protection grounds relating to the proposed subprocessor. CyfroSec will work in good faith to address the concern and, where commercially reasonable, offer an alternative. Available remedies are governed by the applicable DPA and customer agreement.
To request further information or subscribe to material subprocessor-change notices, contact privacy@cyfrosec.com.