When you use eIDAS Pro, we act as a data processor on your behalf. The third parties below may process data as part of delivering the service. We publish this list in full, without gating, in the interest of transparency.
| Sub-processor | Role | Data processed | Where the data is stored | Transfers outside the EEA |
|---|---|---|---|---|
| Macronet System Kft. (Baja, Hungary; macronet.hu) | Server hosting | All data the service handles on our servers, including web server logs and database backups | Hungary (EU) | None |
| Supabase Pte. Ltd. (Singapore) | Database (PostgreSQL) | Merchant accounts, verification sessions, verification audit records, partner records and newsletter sign-ups | Frankfurt, Germany (AWS eu-central-1) | Supabase and its US affiliate can access the data from Singapore and the United States. Safeguard: SCCs (Supabase is not certified under the EU–US Data Privacy Framework) |
| Stripe Payments Europe, Limited (Ireland) | Billing and payments | Merchant billing and subscription data; no data about people who verify | Stripe's global platform | Onward transfer to Stripe, LLC (United States) under the EU–US Data Privacy Framework, with SCCs as fallback |
| Plus Five Five, Inc. (Resend; United States) | E-mail delivery | E-mail addresses and message content (sign-in links, notifications, newsletters) of merchants, partners, newsletter subscribers, people who contact our support and our operators; no data about people who verify | United States (account data and logs); e-mails are sent through an EU sending region | EU–US Data Privacy Framework and SCCs |
| Functional Software, Inc. (Sentry; United States) | Error monitoring | Error reports with limited technical context; IP addresses are not sent | Frankfurt, Germany (EU region) | Access from the United States is possible. Safeguard: EU–US Data Privacy Framework, with SCCs as fallback |
| Cloudflare, Inc. (Turnstile; United States) | Bot protection on our website forms and the public demo; not used in merchants' verification flows | IP address and browser signals during the check | Cloudflare's global network | EU–US Data Privacy Framework, with SCCs as fallback |
SCCs are the EU Standard Contractual Clauses adopted by the European Commission.
Our website analytics (Umami) and our cache run on our own servers; no further third party is involved.
Independent controllers
When a person verifies with bank identity (iDIN), IDURA (Idura ApS, Denmark), our identity broker, and Bluem, the iDIN service provider, carry out the identification as independent controllers, as does the person's own bank. They are therefore not sub-processors. See our Privacy Policy for details.
Cloudflare runs the Turnstile check on our behalf. For the signals it collects during the check, Cloudflare also acts as an independent controller under its own Turnstile privacy policy, using them to improve Turnstile.
This list may change as the service evolves. We announce new or replaced sub-processors at least 30 days in advance, as set out in our Terms of Service.
Download the DPA sample
Get a sample Data Processing Agreement for your legal team to review.
Sample template — not legal advice, subject to change. The binding DPA is the version executed between the parties.