Clarium Systems Limited uses the following third-party sub-processors to deliver its service. All sub-processors are bound by data processing agreements and process personal data only as directed by Clarium. All infrastructure sub-processors operate within the European Union.
We will notify account administrators of any material changes to this list at least 30 days before they take effect.
Infrastructure & Hosting
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Microsoft Azure | Application hosting, database, file storage, authentication infrastructure | North Europe (Dublin) primary; West Europe (Amsterdam) DR | Microsoft DPA |
| Azure Communication Services | Transactional email delivery (app notifications, invitations, exports) | North Europe (Dublin, Ireland) | Covered by Microsoft DPA |
| Cloudflare | CDN, DDoS mitigation, DNS — static marketing site assets only; no personal data persisted | Global CDN (static assets); EU for any personal data | Cloudflare DPA |
Payment Processing
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Revolut Business | Payment card processing and billing management. Full card data held by Revolut only; Clarium stores last 4 digits. | EU (Revolut operates under EU banking licence) | Yes — Revolut Merchant Services Agreement |
AI Processing
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Microsoft Azure AI Foundry | AI extraction of GDPR data fields from customer-uploaded documents (transient processing only) | Sweden Central (primary); France Central / Germany West Central (failover) | Covered by Microsoft DPA |
Error Monitoring
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Sentry (EU) | Error monitoring and performance tracking (PII scrubbed before transmission) | EU (Frankfurt, Germany) | Sentry DPA (EU region) |
Marketing Email
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Resend Inc. | Marketing & waitlist email delivery. Only engaged if you voluntarily submit the marketing site waitlist form — not used for core product/customer data. | US entity; EU sending region (Dublin, Ireland) | Yes — DPA + SCCs in place |
Consent & Analytics
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| CookieYes | Cookie consent management — records visitor consent preferences on the marketing site | EU | Available on request |
Change Notifications
If we add a new sub-processor or make a material change to an existing one, we will notify account administrators by email at least 30 days before the change takes effect. You may object to a new sub-processor by contacting [email protected] within 14 days of notification.