Legal

Sub-processors

Last updated: 7 October 2026 Data Processing Addendum

Third-party services that help us run Vaultiqo and may process customer personal data. This list is part of the Data Processing Addendum.

Sub-processors

Google Cloud

Google Cloud EMEA Limited, Ireland

EU, Belgium (europe-west1)

Purpose: Application hosting (Cloud Run), database (Cloud SQL), backups, file storage (Cloud Storage), key management (Secret Manager), operational logs
Safeguard for transfers outside the EU: Data is stored in the EU. Any access from third countries is covered by standard contractual clauses in the Google Cloud Data Processing Addendum.

Google

Google LLC, USA

USA and Google’s global network

Purpose: Sign in with Google (OAuth and OpenID Connect), importing users and groups from Google Workspace, account security signals (Cross-Account Protection)
Safeguard for transfers outside the EU: EU-US Data Privacy Framework, standard contractual clauses

Stripe

Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA

EU and USA

Purpose: Payments, subscriptions, invoices and tax. Processes the organization’s billing contact (administrator email, company name, address, VAT ID)
Safeguard for transfers outside the EU: EU-US Data Privacy Framework, standard contractual clauses

Services that receive no personal data

These services are not sub-processors because we send them no personal data:

Have I Been Pwned

breached password checks

The browser sends only the first 5 characters of a password hash (k-anonymity).

DuckDuckGo

website icons

The server sends only the website domain of an item, for example google.com, and nothing else.

Storage in the customer’s own account

If a customer on the Pro plan chooses its own Google Drive or its own Google Firestore project, the encrypted data and attachments are stored in its own Google account. Google processes that data under the contract between the customer and Google, not as our sub-processor.

Changes

We publish planned changes on this page in advance. Section 6 of the Data Processing Addendum covers objections.