Subprocessors
Last updated: August 18, 2026
Certyneo uses the providers below to operate its service. Under Article 28 of the GDPR, these are our subprocessors: they process data on our behalf, under our instructions, and are bound by contract. This list covers those who are actually in production today.
| Subprocessor | Purpose | Data categories |
|---|---|---|
| IONOS SE | Hosting of application servers and database, and backup SMTP relay. Servers are located in the European Union. | All service data, in the capacity of hosting provider. |
| Cloudflare, Inc. | Content delivery network, DNS resolution and abuse protection. Traffic passes through this network before reaching our servers. | IP address, connection headers and metadata. |
| Scaleway SAS | Encrypted backups of object storage and database, hosted in France. | Encrypted copies of documents and database backups. |
| Resend (Plus Five Five, Inc.) | Sending of transactional emails (signing invitations, notifications, password reset) and newsletter. | Email address, recipient name and message content sent. |
| Twilio Inc. | Sending one-time codes by SMS, used for advanced electronic signature. | Phone number and one-time code. |
| Stripe, Inc. | Subscription payments and billing. Card numbers are entered at Stripe and never pass through our servers. | Billing details and payment data. |
| Functional Software, Inc. (Sentry) | Monitoring of application errors, to detect and correct incidents. | Technical error logs, account identifier and request context. |
Artificial intelligence functions
AI analysis functions, such as contract review, rely on a third-party AI provider established outside the European Union, governed by a subprocessing agreement and by the standard contractual clauses of the European Commission. The content you submit is transmitted for the duration of the analysis and is not retained by Certyneo once the response is provided. The identity of this provider is communicated upon request to privacy@certyneo.com, in particular as part of an audit or impact assessment.
What is not subprocessed
The main object storage, which contains your documents and their signature proofs, operates on our own servers: these files are not entrusted to any third-party service provider, except for the encrypted backups mentioned above. Similarly, login via a Google or Microsoft account does not transmit any data to these providers: your identity provider communicates your email address to us, never the other way around.
Changes to this list
This page is updated whenever a subprocessor is added or replaced. To be informed of changes, or to obtain our subprocessing agreement, write to privacy@certyneo.com.
A question about this list? Write to us at privacy@certyneo.com. See also our privacy policy.