Subprocessors
These companies process personal data for KITSIS CRM so that we can provide the Service. Each one is bound by a data processing agreement. Before we add or replace one, we email the Owners of every workspace at least 30 days in advance, as the Data Processing Agreement says.
| Subprocessor | What for | Which data | Where | Safeguard for transfers |
|---|---|---|---|---|
| DigitalOcean, LLC (USA) | servers and database | all Customer Data | Frankfurt, Germany | Data Privacy Framework, Standard Contractual Clauses |
| OVH SAS (France) | file storage, encrypted backups | files; encrypted backups | France | in the EU |
| Backblaze, Inc. (USA) | second copy of encrypted database backups | encrypted backups only; Backblaze has no key | Amsterdam, Netherlands | Data Privacy Framework, Standard Contractual Clauses |
| Vercel Inc. (USA) | delivery of kitsiscrm.com and the web app; relaying downloads of email attachments | IP addresses and request data; attachment files in transit | global network, including the USA | Data Privacy Framework, Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) (USA) | error reports | technical data with personal data masked | EU data region (Frankfurt) | Data Privacy Framework, Standard Contractual Clauses |
| Google (Google Workspace) | sending service emails: codes, notices | email addresses, names, email text | EU and USA | Data Privacy Framework, Standard Contractual Clauses |
Not on this list
- Services you connect yourself: mailboxes (Gmail, Microsoft 365 and others), telephony (for example CallGear), advertising platforms (for example Meta lead forms). They work under your own agreement with them.
- Stripe processes payments for KITSIS subscriptions. It handles billing data of companies, not Customer Data in the CRM.
- Push services of browser makers (Apple, Google, Mozilla) only carry notifications encrypted for the device (RFC 8291).
History of changes
- 4 October 2026: first published list.