← Back to DPA

Sub-processors

Article 28(2) GDPR · CCPA Service Provider posture · 18 vendors

The following third parties (the “Sub-processors”) Process Personal Data on Ataski’s behalf in the course of providing the Service. Each Sub-processor is bound by a written agreement with obligations no less protective than those in Ataski’s Data Processing Agreement. Ataski provides 30 days’ prior notice via in-app banner and email to the workspace admin before adding or removing any Sub-processor; Customer may object on reasonable grounds during that window.

Last updated: 2026-06-05 · List fingerprint: 8f39b75edc931a76…

Sub-processor Purpose Country Data categories DPA
Hetzner Online GmbH Application server hosting (CCX23 Ashburn) Germany (data center USA)
  • all customer data via application access
 Vendor DPA ↗
Neon, Inc. Postgres database hosting USA
  • all customer data via RLS
 Vendor DPA ↗
Cloudflare, Inc. DNS, CDN, WAF, R2 object storage (PDFs, HTML snapshots) USA
  • board pack PDFs
  • HTML snapshots
  • static assets
  • network metadata (IP, request path)
 Vendor DPA ↗
WorkOS, Inc. Authentication (SSO / SAML / passwordless) USA
  • authentication credentials
  • user identity
 Vendor DPA ↗
Wildbit, LLC (Postmark) Transactional email delivery + inbound webhook USA
  • recipient email addresses
  • email body content
 Vendor DPA ↗
Anthropic, PBC Worker LLM inference (Claude API) USA
  • user prompts
  • model outputs
 Vendor DPA ↗
OpenAI, OpCo, LLC Cross-family supervisor LLM + embeddings USA
  • user prompts
  • model outputs
  • embedding inputs
 Vendor DPA ↗
Google LLC (Vertex AI / Gemini) Tier-3 tiebreaker LLM when worker and supervisor disagree USA
  • user prompts
  • model outputs
 Vendor DPA ↗
Recall.ai (Reduct Video, Inc.) Meeting bot identity + transcription (Meeting Coordinator, Board Pack co-pilot) USA
  • meeting audio
  • meeting transcripts
  • participant names and emails
  • meeting chat messages
 Vendor DPA ↗
Bright Data Ltd MCP-orchestrator primary: SERP search, Web Unlocker, firmographic datasets Israel (global data centers)
  • customer ICP query
  • public-web search results
  • company and team page extractions
 Vendor DPA ↗
Perplexity AI, Inc. Sonar API — search and synthesis for personalization context USA
  • email or domain inputs
  • public-web summaries
 Vendor DPA ↗
ZeroBounce, Inc. Email deliverability verification (PAYG, no vendor-side PII retention) USA
  • email addresses submitted for verification
 Vendor DPA ↗
Apify Technologies s.r.o. Pre-built actors for non-LinkedIn scraping and signal aggregation Czech Republic (EU)
  • per-actor query inputs
  • structured public-web extractions
 Vendor DPA ↗
Stripe, Inc. Billing / payment processing (Checkout, customer portal, Stripe Tax) USA
  • billing details
  • subscription data
 Vendor DPA ↗
Langfuse GmbH LLM trace storage (async-pushed prompts + completions) Germany (EU)
  • LLM prompt content
  • LLM completion content
  • model and cost metadata
 Vendor DPA ↗
Bugsink B.V. Error tracking (Sentry-compatible, PII off by default) Netherlands (EU)
  • stack traces
  • request metadata (tenant_id, correlation_id)
 Vendor DPA ↗
PostHog, Inc. Product analytics (page-view and event telemetry) USA
  • page-view events
  • anonymized session traces
 Vendor DPA ↗
Better Stack sp. z o.o. (Logtail) Uptime monitoring and heartbeats Poland (EU)
  • endpoint health metadata
 Vendor DPA ↗

What does “sub-processor” mean?

A sub-processor is any third party Ataski engages to Process Personal Data on Customer's behalf (GDPR Article 28(4)). Customers are not asked to negotiate with each sub-processor individually; instead, Ataski warrants in the master DPA that each sub-processor is bound by back-to-back data protection obligations and that Ataski remains liable to Customer for sub-processor performance.

What gets notified when this list changes?

Adding, removing, or materially changing a sub-processor triggers a 30-day notice to every workspace admin email on file, plus an in-app banner on the affected role's dashboard. Customer may object within that window. The above fingerprint changes with the list, so external monitoring can detect change without polling per-vendor.

Why isn't my favourite vendor here?

Ataski operates as a CCPA Service Provider (Cal. Civ. Code §1798.140(ag)) and is not a data broker. We do not engage data-broker sub-processors (Hunter, Apollo, ZoomInfo, Crunchbase, Coresignal). Contact discovery uses public-source compose patterns and customer-supplied lists per our security posture.