Subprocessors
Last updated: 7 November 2026
What this list covers
For the data in Symiko we act as processor for our customers (Art. 28 GDPR). We use the following service providers as subprocessors. Each is bound by a contract imposing the same data protection obligations as ours. We announce new or changed subprocessors to our customers in advance; they can object as set out in the data processing agreement.
This page also provides the information required by Art. 28 Data Act (jurisdiction of the infrastructure used). For switching providers and exporting data see Data export and switching; for details of processing see the privacy policy.
Service providers
Supabase Pte. Ltd.
- Address
- 65 Chulia Street #38-02/03, OCBC Centre, Singapur 049513
- Jurisdiction
- Singapore (group headquartered in the USA)
- Place of processing
- Data centre in Frankfurt am Main (Amazon Web Services, region eu-central-1); access for operations and support also from third countries
- Purpose
- Database, authentication, file storage, real-time notifications
- Data
- All application data
- Transfer basis
- EU standard contractual clauses (Art. 46(2)(c) GDPR)
- Further subprocessors
- Amazon Web Services EMEA SARL (Luxembourg) for hosting in Frankfurt and further providers according to Supabase’s list
Vercel Inc.
- Address
- 440 N Barranca Ave #4133, Covina, CA 91723, USA
- Jurisdiction
- USA
- Place of processing
- Server functions in Frankfurt am Main (region fra1); global delivery network for page requests
- Purpose
- Delivery of website and application, server functions, scheduled jobs
- Data
- All requests including IP address; content in transit
- Transfer basis
- EU standard contractual clauses; additionally certified under the EU-US Data Privacy Framework including HR data (Art. 45 GDPR)
- Further subprocessors
- Amazon Web Services and others according to Vercel’s list
Plus Five Five, Inc. (Resend)
- Address
- 2261 Market Street #5039, San Francisco, CA 94114, USA
- Jurisdiction
- USA
- Place of processing
- USA
- Purpose
- Sending all emails (login, invitations, notifications, newsletters, applications, orders)
- Data
- Recipients, subject and content of emails
- Transfer basis
- EU standard contractual clauses; the EU-US Data Privacy Framework certification covers only non-HR data – for employee data the standard contractual clauses apply alone
650 Industries, Inc. (Expo)
- Address
- Burlingame, Kalifornien, USA
- Jurisdiction
- USA
- Place of processing
- USA
- Purpose
- Delivery of push notifications to the app
- Data
- Device token; title and text of the notification (e.g. names, up to 140 characters for chat messages); internal identifiers. Content is processed only for delivery, not stored.
- Transfer basis
- EU standard contractual clauses; additionally certified under the EU-US Data Privacy Framework including HR data (Art. 45 GDPR)
- Further subprocessors
- Apple Inc. (Apple Push Notification service, USA) and Google (Firebase Cloud Messaging)
Cloudflare, Inc.
- Address
- 101 Townsend Street, San Francisco, CA 94107, USA
- Jurisdiction
- USA
- Place of processing
- Storage in the EU
- Purpose
- Storage for daily backups
- Data
- Full backup, encrypted before upload; only Symiko holds the key
- Transfer basis
- EU standard contractual clauses; additionally certified under the EU-US Data Privacy Framework including HR data (Art. 45 GDPR)
Apple Distribution International Ltd. (iCloud)
- Address
- Hollyhill Industrial Estate, Hollyhill, Cork, Irland
- Jurisdiction
- Ireland (group headquartered in the USA)
- Place of processing
- Data centres operated by Apple
- Purpose
- Second copy of the encrypted backup
- Data
- Only encrypted backup files; only Symiko holds the key
- Transfer basis
- Processing by an EU provider; data not readable by Apple
Anthropic Ireland, Limited
- Address
- Dublin, Irland
- Jurisdiction
- Ireland (group headquartered in the USA)
- Place of processing
- USA and other countries according to Anthropic’s list
- Purpose
- AI features: set-up assistant for food safety, matching columns in the staff import, reading a rota
- Data
- Content of the assistant conversation; for imports only column names, masked examples or the table layout with placeholders instead of names. No training, deletion after 30 days at the latest.
- Transfer basis
- EU standard contractual clauses (Art. 46(2)(c) GDPR)
- Further subprocessors
- Anthropic, PBC (USA) and others according to Anthropic’s list
IONOS SE
- Address
- Elgendorfer Straße 57, 56410 Montabaur, Deutschland
- Jurisdiction
- Germany
- Place of processing
- Germany
- Purpose
- Mailbox hello@symiko.de (support, enquiries)
- Data
- Emails to Symiko, e.g. support requests
- Transfer basis
- Processing in the EU
Protection against access from third countries
Database and files are stored in Frankfurt am Main. Data is encrypted in transit (TLS) and at rest (encryption by the provider); backups are additionally encrypted with a key that only we hold. Providers only get access to customer data as far as their service requires. If an authority of a third country demands access to customer data, we assess the request, disclose data only where Union and Member State law allows it (Art. 48 GDPR, Art. 32 Data Act), challenge unlawful requests and inform the customer where permitted. We have imposed the same obligations on our providers by contract.
Not on this list
Web push notifications in the browser are delivered by the push service of the respective browser vendor; the content is end-to-end encrypted. To check passwords against known data breaches we only send the first five characters of a hash to the “Pwned Passwords” service; neither the password nor the person can be derived from it.