TRUST · SUB-PROCESSORS

Public list
of sub-processors.

GDPR Art. 28 requires transparency about the sub-processors we use to provide you the service. Here we publish the complete list, their location, purpose and the transfer safeguards for each one. We notify you by email 30 days in advance of any change.

See pricing Subscribe to notifications

Why we publish this list

As processor of your personal data and your endpoint inventory data, European Digital Stores SL commits to not engaging sub-processors without your knowledge. GDPR Art. 28(2) requires specific or general written prior authorization before engaging another processor. We operate under general authorization with 30-day prior notification, allowing you to object and, if applicable, terminate the contract if you don't accept.

This list was last updated in August 2026. Any change (new sub-processor, location change, sub-processor removal) is notified by email to your organization's registered contact and to anyone subscribed to notifications by writing to legal@aitamit.com.

With each sub-processor we maintain a data processing agreement in line with GDPR Art. 28 and, where a transfer outside the EU exists, Standard Contractual Clauses (SCC). Email and backups do not appear on the list because they run on EDS-owned infrastructure in the EU, not third parties.

CURRENT SUB-PROCESSORS

Active sub-processors list

IONOS SE (hosting)

Hosting of the Aitamit platform on VPS servers in Germany, managed by European Digital Stores SL. Location: Germany (EU). Purpose: main service hosting. IONOS Art. 28 data processing agreement. No transfer outside the EU.

Stripe (payments)

Payment and subscription processing via Stripe Billing. The payment method is stored in Stripe, never in Aitamit. Location: United States. Purpose: billing of service subscriptions. Stripe data processing agreement + SCC for the international transfer.

Anthropic (optional AI assistant)

Provider of Aitamit's optional AI assistant. It only processes the text of the queries the user writes to the assistant; if you don't enable it, no processing takes place. Location: United States. Purpose: optional AI assistant. Anthropic data processing agreement + SCC.

Own infrastructure (not sub-processors)

Product email (notifications, alerts, reports) is sent from EDS's own mail server, located in the EU. Backups are kept as a hot replica on a mirror VPS in the EU (synchronized every 15 minutes) plus an encrypted nightly off-site backup on EDS infrastructure, also in the EU. As infrastructure operated directly by EDS, these are not external sub-processors, which is why they don't appear on the list.

  • Email notification: 30 days before any change to this list
  • Hosting and email: in the EU (Germany and EDS-owned infrastructure)
  • Stripe and Anthropic: outside the EU, covered by SCC
  • Safeguards: Art. 28 data processing agreement with each sub-processor
FAQ

Sub-processor questions

Do I have to accept all sub-processors?
We operate under general authorization (GDPR Art. 28(2)) with 30-day prior notification. If you don't accept a new sub-processor, you have the right to object and, if we don't offer an alternative, the right to terminate the contract without penalty.
How do you notify me of changes?
By email to your organization's registered contact, 30 days in advance, with a description of the sub-processor, its location and purpose. You can also subscribe to notifications by writing to legal@aitamit.com.
Is my payment data stored in Aitamit?
No. The payment method is stored in Stripe and subscriptions are managed with Stripe Billing. Aitamit never stores card data.
Is the AI assistant mandatory?
No, it's optional. If you enable it, only the text of the queries you write to the assistant is processed with the Anthropic API (US, covered by SCC). If you don't use it, no data goes to Anthropic.

Subscribe to notifications

Write to legal@aitamit.com and we will notify you by email whenever we add, change or remove sub-processors.

See pricing Subscribe