Sub-processors
Last updated: 30 October 2026
To provide the OK-GRC platform, ESERENIT uses the sub-processors below. In line with the data processing agreement, we inform customers of any addition or replacement at least 30 days in advance, so they can object. The marketing website itself uses no analytics or advertising tool.
| Sub-processor | Purpose | Data concerned | Location | Safeguards |
|---|---|---|---|---|
| IONOSIONOS SE (Allemagne) / IONOS SARL (France) | Hosting of the application, database, object storage (evidence) and backups | All platform data (accounts, compliance data, files) | European Union (data centre to be specified) | Data hosted in the EU, data processing agreement (Art. 28), encryptionTo be verified |
| StripeStripe Payments Europe, Ltd. (Irlande) | Subscription payments, invoicing, VAT calculation | Billing data: name, email, address, VAT number, payment method (handled by Stripe) | European Union, with possible transfers outside the EU | Stripe data processing agreement, standard contractual clauses, PCI DSS certificationTo be verified |
| BrevoSendinblue SAS (Brevo), France | Sending transactional emails (invitations, reminders, notifications) and the newsletter | Email address, name, language, email content, deliverability statistics | European Union | Data processing agreement (Art. 28), hosting in the EUTo be verified |
| AnthropicAnthropic, PBC (États-Unis)Optional | AI assistant (Claude models): generating the drafts requested by usersCan be turned off or replaced by a local model | Texts sent to the assistant (document extracts, descriptions); optional masking of personal data | United States | Anthropic commercial terms and data processing addendum, standard contractual clauses; no use for training under the commercial termsTo be verified |