Sub-processors
Last updated 1 June 2026 · Aligned with DPA Schedule A
Contents
Last updated: 1 June 2026 · Aligned with Data Processing Agreement (DPA), Schedule A, Version 1.1.
1. How to read this list
In providing our services we process personal data you entrust to us, and for part of that processing we use sub-processors — suppliers who handle a specific technical function for us (hosting, email delivery, payments, AI models).
This list is the binding overview of all sub-processors referred to in clause 5.2.4 of the DPA. It is identical to Schedule A of the DPA and we keep it current.
What this means for you:
- Every sub-processor is bound by an equivalent data processing agreement with the same level of protection you have with us.
- We notify you in advance of any change of sub-processor under clause 5.2 of the DPA. You may raise a reasoned objection within 14 days of notification.
- For transfers outside the EU/EEA we rely on Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914, or on the EU-US Data Privacy Framework. The specific safeguard is stated for each supplier in the “Security” column.
- AI Team data does not leave the EU/EEA at the hosting level — it runs on Hetzner servers in Germany and Finland.
2. Primary platform and hosting infrastructure
| Sub-processor | Country | Purpose | Security |
|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Server hosting infrastructure for the Cliqsales AI Team software (Appendix B and Appendix F) — dedicated EU data centres (Falkenstein / Nuremberg / Helsinki) | ISO 27001 (Hetzner), GDPR-compliant (EU established, no international transfer) |
| HighLevel Inc. (GoHighLevel) | USA | Provision of CRM platform, database, email/SMS infrastructure for the Cliqsales AI CRM (Appendix C) | SOC 2 Type II, EU-US DPF, SCCs |
| Cloudflare Inc. | USA | CDN, DDoS protection, security, infrastructure | ISO 27001, EU-US DPF, SCCs |
3. Communication services
| Sub-processor | Country | Purpose | Security |
|---|---|---|---|
| Twilio Inc. | USA | SMS delivery | SOC 2, ISO 27001, SCCs |
| Mailgun (Sinch Email) | USA | Email infrastructure | SOC 2, SCCs |
| SendGrid (Twilio) | USA | Email infrastructure | SOC 2, SCCs |
4. AI and analytics services (under Cliqsales accounts)
The providers below are our sub-processors only when we connect them under our own account — typically for the Cliqsales AI CRM, the customer portal and our internal operations. For AI models connected by the customer under its own credentials in the AI Team (Schedules B and F), see section 5 below and DPA § 5.4.
| Sub-processor | Country | Purpose | Security |
|---|---|---|---|
| OpenAI, L.L.C. | USA | AI models (GPT) — Business/Enterprise tier, under Cliqsales accounts | SOC 2 Type II, SCCs Module 2/3, zero training default |
| Anthropic PBC | USA | AI models (Claude) — Commercial Agreement, under Cliqsales accounts | SOC 2 Type II, SCCs Module 2/3 under Implementing Decision (EU) 2021/914, zero training default |
| Google LLC | USA | Google AI / Gemini, Google Workspace, under Cliqsales accounts | SOC 2, ISO 27001, EU-US DPF, SCCs |
| Mistral AI | EU (France) | AI models, under Cliqsales accounts | GDPR-compliant (EU established) |
5. Services connected by the customer (not sub-processors)
In the AI Team (Schedules B and F), the customer connects AI model providers and certain third-party services under its own account or API key — without the customer’s credentials these functions do not operate. Typical examples include ChatGPT / Codex individual subscriptions, an OpenRouter API key, a Fireflies API key or another provider selected by the customer.
These providers are not our sub-processors within the meaning of § 1.1.4 of the DPA. The contractual relationship arises directly between the customer and the provider; the customer chooses the plan and settings (including whether the provider may use inputs to train its models). See DPA § 5.4 for the full framework.
The list of concrete providers a customer connects in this way is intentionally not maintained here — it changes with the customer’s choices and available integrations.
6. Payment services
| Sub-processor | Country | Purpose | Security |
|---|---|---|---|
| Stripe Payments Europe Limited | Ireland (EU) | Payment processing in EU | PCI-DSS Level 1, GDPR-compliant |
| Stripe, Inc. | USA | Payment processing outside EU | PCI-DSS Level 1, EU-US DPF, SCCs |
7. Conferencing and collaboration tools
| Sub-processor | Country | Purpose | Security |
|---|---|---|---|
| Zoom Video Communications, Inc. | USA | Online workshops and calls, under Cliqsales accounts | SOC 2, ISO 27001, EU-US DPF, SCCs |
| Fireflies.ai | USA | Call transcripts and summaries on Cliqsales’ own calls (with customer consent), under Cliqsales accounts | SOC 2, SCCs |
Note on Fireflies. Fireflies may also be connected by the customer under its own API key in the AI Team (Appendix F clause F7.1, and section 5 above). In that regime Fireflies is not a sub-processor of Cliqsales — see DPA § 5.4.
8. Abbreviations
- SCCs — Standard Contractual Clauses under Implementing Decision (EU) 2021/914
- EU-US DPF — EU-US Data Privacy Framework
- SOC 2 — Service Organization Control 2
- ISO 27001 — International Standard for Information Security Management
- PCI-DSS — Payment Card Industry Data Security Standard
- GDPR — Regulation (EU) 2016/679
9. Questions about a sub-processor?
Write to us at info@cliqsales.com. On request we will evidence the contractual safeguards for any supplier on this list, including a copy of the applicable Standard Contractual Clauses.
The full wording of our commitments is in the Data Processing Agreement and the Privacy Policy.
Last updated: 1 June 2026 · Contact: info@cliqsales.com