Sub-processors

Article 28(2) GDPR · CCPA Service Provider posture · 16 vendors

The following third parties (the “Sub-processors”) Process Personal Data on Ataski’s behalf in the course of providing the Service. Each Sub-processor is bound by a written agreement with obligations no less protective than those in Ataski’s Data Processing Agreement. Ataski provides 30 days’ prior notice via in-app banner and email to the workspace admin before adding or removing any Sub-processor; Customer may object on reasonable grounds during that window.

Last updated: 2026-10-07 · List fingerprint: b6fcf738e3f0ee6f…

Sub-processor	Purpose	Country	Data categories	DPA
Hetzner Online GmbH	Application server hosting	Germany (data center USA)	all customer data via application access	Vendor DPA ↗
Neon, Inc.	Postgres database hosting	USA	all customer data via RLS	Vendor DPA ↗
Cloudflare, Inc.	Authoritative DNS (records not proxied) and R2 object storage for files	USA	uploaded documents (contracts, support attachments) generated PDFs (board packs, reports) HTML snapshots meeting transcripts	Vendor DPA ↗
WorkOS, Inc.	Customer sign-in and session management (email, passwordless, multi-factor)	USA	authentication credentials user identity	Vendor DPA ↗
ActiveCampaign, LLC (Postmark)	Transactional email delivery and inbound email	USA	recipient email addresses email body content	Vendor DPA ↗
Anthropic, PBC	AI model inference (Claude API) for drafting and review	USA	user prompts model outputs	Vendor DPA ↗
Hyperdoc Inc. (d/b/a Recall.ai)	Meeting bot identity + transcription for any role that joins a live meeting on the customer's behalf	USA	meeting audio meeting transcripts participant names and emails meeting chat messages	Vendor DPA ↗
Bright Data Ltd	Public-web search and company page extraction for prospect research	Israel (global data centers)	customer search criteria (industry, location, keywords) public-web search results company and team page extractions	Vendor DPA ↗
Perplexity AI, Inc.	Public-web search and summaries used to personalise outreach	USA	email or domain inputs public-web summaries	Vendor DPA ↗
ZeroBounce, Inc.	Email deliverability verification (pay-as-you-go)	USA	email addresses submitted for verification, kept by ZeroBounce only as its DPA allows	Vendor DPA ↗
Apify Technologies s.r.o.	Outbound prospect discovery from public LinkedIn data, run by Ataski under its own Apify account with no LinkedIn login: company search, the website a company publishes on its LinkedIn page, and people-at-company identity records (no email, no phone)	Czech Republic (EU)	customer search criteria (keywords, industry, location, job titles) public company records, including LinkedIn company page URL and website public professional identity records (name, job title, employer, LinkedIn profile URL, location)	Vendor DPA ↗
Stripe, Inc.	Billing and payment processing (checkout, customer portal, sales tax)	USA	billing details subscription data	Vendor DPA ↗
Langfuse GmbH	AI request tracing for quality monitoring (prompts and completions)	Germany (data center USA)	LLM prompt content LLM completion content model and cost metadata	Vendor DPA ↗
Bugsink B.V.	Error tracking (personal data scrubbed by default)	Netherlands (EU)	stack traces request metadata (workspace and request identifiers)	Vendor DPA ↗
PostHog, Inc.	Product analytics (server-side sign-up and activation events)	USA	event names and timings workspace identifier (no names, emails or content)	Vendor DPA ↗
Better Stack, Inc.	Uptime monitoring and heartbeats	USA	endpoint health metadata	Vendor DPA ↗

What does “sub-processor” mean?

A sub-processor is any third party Ataski engages to Process Personal Data on Customer's behalf (GDPR Article 28(4)). Customers are not asked to negotiate with each sub-processor individually; instead, Ataski warrants in the master DPA that each sub-processor is bound by back-to-back data protection obligations and that Ataski remains liable to Customer for sub-processor performance.

What gets notified when this list changes?

Adding, removing, or materially changing a sub-processor triggers a 30-day notice to every workspace admin email on file, plus an in-app banner on the workspace Settings page. Customer may object within that window. The above fingerprint changes with the list, so external monitoring can detect change without polling per-vendor.

Why isn't my favourite vendor here?

Ataski operates as a CCPA Service Provider (Cal. Civ. Code §1798.140(ag)) and is not a data broker. We do not engage data-broker sub-processors (Hunter, Apollo, ZoomInfo, Crunchbase, Coresignal). Contact discovery uses public-source compose patterns and customer-supplied lists per our security posture.