Subprocessors

Every company that touches
your data, named.

The live annex to our Data Processing Agreement: platform providers that are always active, channels and integrations that engage when you connect them, and AI inference inside your region policy — with regions and transfer mechanisms for each.

Read the DPA Security controls

Last updated 9 November 2026 · GRUPO OITO OÜ, Tallinn, Estonia

A subprocessor list you cannot read is a privacy policy with extra steps. This one is maintained like a product page — versioned, dated, announced.

Always on — the platform floor.

Every workspace uses these, on every plan, in every region configuration.

01
Amazon Web Services
Compute, database, managed AI services and email delivery. AWS's DPA with EU standard contractual clauses is incorporated into the service terms; AWS is EU–US Data Privacy Framework certified.
cloud infrastructure
EU regions
02
Scaleway
File and asset storage, processed entirely within the EU by the French entity. ISO 27001 certified; DPA published.
object storage
EU · France
03
BunnyCDN
Content delivery, storage edge and DNS, from EU edge locations only. EU-based operator (Slovenia); DPA available.
CDN · DNS · edge
EU edge locations

AI providers, pinned to your policy.

When they engageengagement

01Only when AI features are on — and only inside the region policy you set per workspace: US, EU, BR or CN. Requests are masked before they leave the platform, and providers are engaged on zero-data-retention or no-training terms where offered.

Masking reduces personal data in prompts but is not infallible — for a hard guarantee, pin a restrictive region or switch AI off.

Who they arethe names

01Amazon Web Services (Bedrock), Baseten, Cerebras, Cloudflare (Workers AI), Fireworks AI, Google (Gemini), Groq, Nebius, OpenRouter, Scaleway, Voyage and Z.ai. Some serve from EU datacenters; others from the US, China or elsewhere — your region policy decides which are used. OpenRouter is a router: the underlying provider follows the chosen model.

The live catalogue is visible in the workspace, with the region options behind it.

Channels and integrations — active only when you connect them.

These providers deliver the channel you connected. Their own terms govern their processing on your side of the integration.

01
Meta
Messages, phone numbers, profile data, media and delivery metadata, under Meta's business platform terms. An EU entity fronts the service; delivery infrastructure is global.
WhatsApp · Messenger · Instagram · Threads
SCC · DPF
02
Telegram
Messages, usernames, phone numbers and media. Telegram operates from the UAE and globally, with no EU adequacy decision; transfers rely on SCCs and your consent as controller. Listed because you connected it — restrict or remove in settings.
messaging channel
no EU adequacy · SCC + consent
03
Threema
Messages, Threema IDs and media. Swiss provider, Swiss hosting, covered by EU adequacy.
messaging channel

Where data sits, and what moves it.

Core service data is hosted in the EU. Two categories of processing can route outside it — the channels you connect and the AI regions you allow. Both are configuration.

Hosting

The default is EU

Service data is stored and processed in EU regions — EU compute and database, EU object storage, EU analytics, EU edge delivery.

Inherent

Channels follow the provider

A connected channel is delivered from where that provider operates. The mechanism for each is in the list above.

Your control

AI follows your policy

Pin inference to US, EU, BR or CN per workspace — or leave it unlocked. A restrictive policy, or AI off, avoids any routing you did not choose.

SCC · DPF · adequacy

Transfers under named mechanisms

Standard contractual clauses, the EU–US Data Privacy Framework where the provider is certified, EU adequacy decisions or binding corporate rules — with transfer impact assessments for the higher-risk providers. No row on this page relies on trust us.

The questions a DPO
asks first.

Changes to this list are announced, never slipped in. Questions: suporte@bootdesk.eu

How will I know if this list changes?

New platform subprocessors are announced at least 30 days in advance, by email or in-product notice, with a window to object on data-protection grounds. Channel and AI providers never appear silently — they become active only through your own configuration.

Can I run EU-only?

EU hosting is the default for core data. For AI, pin the region to EU in Settings → AI; coverage depends on the model catalog for each feature. Channels are the exception — a connected provider delivers from where it operates, which is inherent to offering the channel.

What is the position on Telegram and China-based models?

Stated plainly: there is no EU adequacy decision for the UAE or China. Those providers are used only if you connect Telegram or allow CN in your AI region policy. A restrictive region policy, or AI off, avoids the routing entirely.

Do AI providers train on our data?

No — and providers are engaged on zero-data-retention or no-training API terms where offered. Requests are masked before they leave the platform. Masking reduces personal data in prompts but is not infallible, which is exactly why region control exists.

Where is the contract behind this page?

The Data Processing Agreement is published on this site — scope, obligations, transfers and deletion windows. A countersigned copy is available on request at suporte@bootdesk.eu.

This page is the map.
The DPA is the contract.

Both are public, both are dated, and neither requires a sales call to read. The list above changes by announcement; the contract governs what happens when it does.

Read the DPA Start the 7-day trial

Ask a vendor where your data is and you get a slogan. Ask which companies touch it and you get a form. This page is the list: named providers, what each one does, which data reaches it, and the mechanism that governs any transfer outside the EU/EEA. It is the live annex to our DPA, not a PDF on request.

Software we operate ourselves — parts of BootDesk running in our own EU infrastructure — is part of the service, not a subprocessor. It is not listed here because it is not a third party.What is deliberately not on this page

Every row below carries the same three facts: the provider's role, the data categories that reach it, and the transfer mechanism where processing happens outside the EU/EEA. Optional providers are active only because you enabled them — and you can disable them the same way. That asymmetry is the point: the always-on list is short, and everything else is your call.

Every company that touches
your data, named.

Always on — the platform floor.

Amazon Web Services

Scaleway

BunnyCDN

AI providers, pinned to your policy.

Channels and integrations — active only when you connect them.

Meta

Telegram

Threema

Where data sits, and what moves it.

The default is EU

Channels follow the provider

AI follows your policy

Transfers under named mechanisms

The questions a DPO
asks first.

How will I know if this list changes?

Can I run EU-only?

What is the position on Telegram and China-based models?

Do AI providers train on our data?

Where is the contract behind this page?

This page is the map.
The DPA is the contract.

Cloudflare

Stripe

PostHog

Slack · Microsoft Teams · Discord

Twilio · Vonage · Telnyx

Shopify · WooCommerce · Tray

TikTok · LinkedIn

Mapbox

Rayobyte

GitHub · GitLab

Browser push networks

Every company that touchesyour data, named.

Always on — the platform floor.

Amazon Web Services

Scaleway

BunnyCDN

AI providers, pinned to your policy.

Channels and integrations — active only when you connect them.

Meta

Telegram

Threema

Where data sits, and what moves it.

The default is EU

Channels follow the provider

AI follows your policy

Transfers under named mechanisms

The questions a DPOasks first.

01How will I know if this list changes?

02Can I run EU-only?

03What is the position on Telegram and China-based models?

04Do AI providers train on our data?

05Where is the contract behind this page?

This page is the map.The DPA is the contract.

Cloudflare

Stripe

PostHog

Slack · Microsoft Teams · Discord

Twilio · Vonage · Telnyx

Shopify · WooCommerce · Tray

TikTok · LinkedIn

Mapbox

Rayobyte

GitHub · GitLab

Browser push networks

Every company that touches
your data, named.

The questions a DPO
asks first.

How will I know if this list changes?

Can I run EU-only?

What is the position on Telegram and China-based models?

Do AI providers train on our data?

Where is the contract behind this page?

This page is the map.
The DPA is the contract.