Contact: privacy@atmoz.io
Atmoz AB (corp. reg. 559345-4001) is the data processor for customer data in the Atmoz platform; the customer is the data controller. This list covers that data only.
We engage the sub-processors below to deliver the service. We give at least 30 days' advance notice before adding or replacing a sub-processor, and customers may object on reasonable data-protection grounds.
All customer data is stored within the EU/EEA. Sub-processors with global operations may access data from outside the EU/EEA for support, engineering, on-call or incident response; such access is covered by the safeguards below. The Safeguards column shows what applies to each sub-processor:
- DPA - a data processing agreement governs the relationship.
- SCCs - EU Standard Contractual Clauses cover any transfer or access outside the EU/EEA. The marking is absent where no such transfer arises.
- DPF - the entity, or its US parent, is certified under the EU-U.S. Data Privacy Framework.
Infrastructure and platform
| Sub-processor | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| Google Cloud Platform - Google Cloud EMEA Ltd / Google LLC | Compute, storage, databases, networking, logging | User account identifiers, application and access logs, customer source documents | EU (Belgium) | DPA · SCCs · DPF |
| Snowflake - Snowflake Inc. | Data warehouse | Transactional and supplier data; contacts in source documents | EU (Frankfurt) | DPA · SCCs · DPF |
| Zitadel Cloud - CAOS AG, Switzerland / ZITADEL Inc., USA | Identity and access management | Name, email address, role, login metadata, end-user IP addresses in authentication logs | EU (Frankfurt) | DPA · SCCs · DPF |
| Scaleway - Scaleway SAS | Transactional email | Recipient email address, message content | France | DPA |
| Grafana Cloud - Raintank Inc. dba Grafana Labs | Observability - service metrics, traces and logs | End-user IP addresses in request logs; service telemetry | EU (Sweden) | DPA · SCCs · DPF |
| Sentry - Functional Software, Inc. | Error tracking | Error diagnostics, scrubbed so that invoice contents, supplier data and personal data do not enter events | EU (Frankfurt) | DPA · SCCs · DPF |
| Amplitude - Amplitude Inc. | Product analytics | Product usage events; user contact data | EU (Frankfurt) | DPA · SCCs · DPF |
| Intercom - Intercom R&D Unlimited Company, Ireland / Intercom, Inc., USA | Customer support | User contact data; support conversation content | EU (Ireland) | DPA · SCCs · DPF |
Amplitude receives product usage data only. It does not receive customer accounting data, document content or emission results. Users will be able to opt out of in-app usage tracking.
AI processing
| Sub-processor | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| Google Vertex AI (serving Anthropic Claude models) - Google Cloud EMEA Ltd / Google LLC | AI models for document parsing, classification and enrichment | Any personal data incidentally present in customer source documents | EU multi-region (model inference may run in any EU region) | DPA · SCCs · DPF |
Anthropic PBC provides the models as Google's sub-processor under the Google Cloud DPA; Atmoz has no direct agreement with Anthropic. Customer data is never used to train or fine-tune AI models - a contractual commitment under the Google Cloud Service Specific Terms.
Questions, or details of our sub-processors' own sub-processors: privacy@atmoz.io