Sub-processors
Annex to the Data Processing Agreement. Last updated: 6 November 2026.
1. Who processes what
Ashio runs the reporting channel on its own infrastructure and uses the three providers below. Each is bound by obligations no less protective than the processing agreement, may process the data only on documented instructions, and may not use it for its own purposes.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Swiss data centre operator | Hosting and database infrastructure | All case data, encrypted at rest | Switzerland |
| Resend | Transactional email: invitations, report alerts and status notifications | Email addresses and the notification text. No report bodies. | Ireland |
| Sentry | Error monitoring | Technical error data. No report content. | Frankfurt, Germany |
All three run inside the EEA or Switzerland, so the data never leaves an adequate jurisdiction: Ireland and Germany are in the EEA, and Switzerland benefits from an EU adequacy decision. Any processing outside the EEA or Switzerland is covered by the Standard Contractual Clauses set out in the Terms of Service.
2. Changes and notice
We give at least 30 days’ notice before a sub-processor is added or replaced, by email to the billing contact on every account and by publishing the change here. The 30 days start on the date shown in the history below, not on the date the change ships.
| Date | Change | Effective |
|---|---|---|
| 6 November 2026 | Support chat moved from Chatwoot Cloud to our own infrastructure at chatwoot.ashio.eu. Chatwoot is no longer a sub-processor; it runs on the hosting in row one. | Immediately |
| 6 November 2026 | This page published, and the list moved here from section 5 of the processing agreement. No provider changed. | Immediately |
3. Right to object
If a change is not acceptable to you, you may object on reasonable data protection grounds within the 30 days. Objections are handled by email, and one message is enough:
Object to a sub-processor change
- Include your organisation, the provider in question, the grounds for the objection, and the date of the notice. The link above opens an email with those fields already laid out.
- While an objection is open we do not engage that provider for your account.
- If we cannot find a solution, you may terminate the affected service and we refund the unused part of the term, as Article 28(2) GDPR provides.
4. Related documents
The processing agreement is the DPA; the technical and organisational measures, including the encryption of report bodies and attachments, are described on the security page. Questions about this list: legal@ashio.eu.