Legal

Sub-processors

Which of us is the controller depends on which data you mean, so this page says it per party rather than once at the top.

• The documents and template content you put into the service. You are the controller or an authorised processor, and we are your processor or sub-processor accordingly. The parties markedsub-processor below handle that content on our behalf — this is the list your own Article 28 obligations point at.
• Your account and sign-in records, your billing identity, and administration of support correspondence. We are the controller of these: we decide why they are held and for how long, because running the account, taking payment and keeping the invoices we issue require it. The parties marked processor below handle those for us. Troubleshooting customer document content remains instructed processing under the DPA.

This page is the canonical list of both.

Last updated

19 October 2026

Notice of changes

30 days for direct appointments; downstream changes as described below.

Contact

support@ristmark.app

1. Cloudflare, Inc.

   DNS, TLS, CDN, website hosting and the network edge in front of the application and API

   Both — see below

   In use in the recorded setup

   Purpose

   Resolves our domains, serves the website and application, and carries every request to and from the application and API.

   Data it touches

   Connection and request metadata such as IP addresses, user agent and requested URL, and the content of requests and responses in transit, including documents you upload, edit and generate. Storage is covered by the R2 row below.

   Location

   Global. Requests are served from whichever Cloudflare location is nearest, which may be outside the EU. We do not have Cloudflare's Data Localization Suite — the paid add-on that would confine TLS termination and edge metadata to the EU — so edge processing is not confined to the EU, and we do not claim that it is.

   Our relationship

   Both. Your document content passes through it on its way to and from the application, as our sub-processor; for the connection metadata that visits to our website produce we are the controller and this is our processor. The object storage below is a separate relationship with the same company.

   Transfer basis

   Standard Contractual Clauses and applicable adequacy arrangements — The self-serve agreement incorporates the DPA. Its EU/UK transfer provisions apply according to the data and destination; EU storage does not exclude international access.

2. Cloudflare, Inc.

   R2 — object storage for uploaded documents and migration artifacts

   Both — see below

   Selected service — production clearance pending

   Purpose

   Holds the bytes behind a migration: the source document you upload, the page images it is rasterized into, and the page images, base PDFs and fonts a live template references. Documents you generate are streamed straight back to you and are never written here.

   Data it touches

   Uploaded source documents, rasterized page images and reconstruction HTML have default age-based cleanup thresholds of 90, 30 and 14 days respectively. Document/version references, ongoing import or review, trash protection and scheduled retries can delay cleanup; these are not maximum retention periods. Images, base PDFs, fonts and reference documents have no separate automatic age expiry. Template purge targets associated images, base PDFs and fonts; reference documents and other unlinked assets can remain for workspace erasure or operator cleanup. Includes personal data inside those documents. See the privacy policy for the separate import-job, workspace-deletion and backup rules.

   Location

   European Union. Both buckets were created under Cloudflare's `eu` jurisdiction — a setting fixed at creation and not changeable afterwards, which holds stored objects and their metadata in the EU. That guarantee is about data at rest in these buckets and does not extend to the edge row above.

   Status

   Set up in the EU jurisdiction (recorded 2026-09-15); the transfer assessment for this relationship must be completed before customer content is stored.

   Our relationship

   Both. For customer content it is our processor or sub-processor, depending on your role. It also holds our erasure register (workspace and member identifiers, a storage location and the erasure date, no document content), which stops an erased workspace returning from a restored backup and currently has no end date; for that register we are the controller and this is our processor. No billing or support data is stored here.

   Transfer basis

   Standard Contractual Clauses — The same company and the same addendum as the edge row above: auto-incorporated into the self-serve subscription agreement and carrying the EU Standard Contractual Clauses. Read 2026-08-17. Note that the Clauses are what covers a transfer; the `eu` jurisdiction setting is a separate, stronger control that keeps these objects in the EU in the first place.

3. Fly.io, Inc.

   Fly Machines — application and document-conversion compute

   Both — see below

   Selected service — production clearance pending

   Purpose

   Runs the API and the document converter. Every document you migrate, edit or generate passes through this compute.

   Data it touches

   Document content in transit and in memory, account identifiers, request metadata, and application logs. Under the data-processing addendum signed on 2026-10-19, data may remain with Fly for up to 90 days after our contract with Fly ends (its annex states 90 days; its deletion clause states 30). That period concerns our contract with Fly, not the end of your use of our service.

   Location

   Frankfurt, Germany (Fly region fra). Fly.io, Inc. is a US company.

   Status

   Configured in Frankfurt under our company account. The data-processing addendum issued to our organisation was signed on 2026-10-19 and is in force; the transfer assessment for this relationship is still to be completed.

   Our relationship

   Both, on one machine. Your document content passes through it as our sub-processor; our own account, usage and log records pass through it as our processor. Fly lists its own sub-processors at fly.io/legal/sub-processors and updates that list at least 30 days before a new one processes our data; under its addendum that update is the only notice it gives. We check that list ourselves and pass changes on as our terms describe.

   Transfer basis

   Standard Contractual Clauses (controller-to-processor form) — The data-processing addendum signed on 2026-10-19 incorporates the 2021 EU Standard Contractual Clauses in their controller-to-processor form, with NUTLET SIA as data exporter. It has no UK addendum. Frankfurt compute alone does not settle international access.

4. Databricks, Inc.

   Managed PostgreSQL

   Both — see below

   Selected service — production clearance pending

   Purpose

   The application database — accounts, workspaces, templates, jobs and usage records.

   Data it touches

   Your email address, the opaque identifier your identity provider issues for you, your workspace membership and role, template content and structure, job history, and usage counters.

   Location

   AWS eu-central-1 (Frankfurt, Germany). The service is Neon; the contracting entity is Databricks, Inc., its US parent.

   Status

   Configured in Frankfurt under our company account. NUTLET SIA signed the Databricks data-processing addendum on 2026-10-19; the transfer assessment for this relationship is still to be completed.

   Our relationship

   Both: customer template content is processed on instructions; account, membership and usage records support our administration. Databricks engages its own downstream providers; its Neon Schedule also identifies Grafana Labs in the United States for infrastructure services, alongside the current Databricks sub-processor list. Under the signed addendum Databricks updates that list and sends notice at least 30 days before a new sub-processor processes our data, to those subscribed to its updates. Once we are subscribed (an open item below), we pass that notice on as our terms describe.

   Transfer basis

   Standard Contractual Clauses and UK Addendum — The Databricks data-processing addendum (version of 2023-07-21) that NUTLET SIA signed on 2026-10-19 incorporates the EU Standard Contractual Clauses, Module Two or Three according to the customer's role, governed by Irish law, and the UK Addendum for UK transfers. Frankfurt storage alone does not settle international access.

   • Amazon Web Services, Inc.

     AWS infrastructure underlying the managed database — engaged by Databricks, Inc., not by us

     Both — see below

     Selected service — production clearance pending

     Purpose

     Our database provider runs on AWS. AWS supplies the compute and storage the database sits on; it is not engaged by us directly for this purpose.

     Data it touches

     Everything in the database, at rest on AWS storage.

     Location

     AWS eu-central-1 (Frankfurt, Germany).

     Status

     Not engaged by us directly: it follows the database provider and its Frankfurt region, so its coverage depends on that provider's agreement, which is not yet recorded.

     Our relationship

     Both data classes follow the database provider. AWS is one of that provider's downstream recipients, not its complete sub-processor chain, and relies on the database provider's agreement.

     Transfer basis

     Standard Contractual Clauses — AWS's data-processing addendum incorporates the June-2021 EU Standard Contractual Clauses (read 2026-08-17). This downstream relationship relies on the database provider's own AWS agreement and onward-transfer terms; our separate AWS account does not establish it.

5. Cloudflare, Inc.

   Cloudflare Email Service — transactional email

   Processor to us — we are the controller

   Selected service — production clearance pending

   Purpose

   Sends the transactional messages the service depends on: welcome, usage-cap warnings, payment failures, and workspace-deletion notices.

   Data it touches

   Recipient email address and message content, including workspace name, plan and usage figures. Cloudflare may scan headers, body and attachments for malware, phishing and spam. Its sending service does not provide a durable message archive.

   Location

   Global. Cloudflare does not publish a processing region for Email Sending, and we do not have its Data Localization Suite, so processing is not confined to the EU.

   Status

   Tested on our staging environment on 2026-09-28. Production sending from ristmark.app must be set up and tested before launch.

   Our relationship

   We decide what transactional mail goes out and why, so we are the controller of it and this is our processor. It is a separate service from the edge and object-storage rows for the same company.

   Transfer basis

   Standard Contractual Clauses and applicable adequacy arrangements — Cloudflare publishes a data-processing addendum with transfer provisions. How it and the Email Service's own terms apply to our account, including onward processing and retention, is not yet confirmed.

6. Amazon Web Services EMEA SARL

   AWS S3 — off-site, object-locked backup of the database and the R2 document store

   Both — see below

   Selected service — production clearance pending

   Purpose

   The off-site copy of last resort. `scripts/backup-db.sh` and `scripts/backup-r2.sh` write an encrypted database dump and a full mirror of the R2 bucket here, so a Cloudflare- or Neon-side failure or account loss does not also take the only copy.

   Data it touches

   Object-store copies encrypted at rest by S3 server-side encryption (AES256), and gpg-encrypted database dumps. Copies are held under a 30-day Object Lock. Our policy is to retire them within 180 days; that every stored version is removed on that schedule is not yet verified, so no maximum lifetime is stated.

   Location

   AWS eu-north-1 (Stockholm, Sweden). Amazon Web Services EMEA SARL is a Luxembourg company; the AWS group is US-headquartered.

   Status

   Backups are run by an operator. Restore and erasure have been rehearsed on our staging environment.

   Our relationship

   Both, mirroring the split of what it copies: your document content, mirrored from R2, is ours to safeguard as your sub-processor; the database dump also carries our own account, billing and usage records, which we control directly as their processor.

   Transfer basis

   Standard Contractual Clauses where applicable — AWS Service Terms incorporate the DPA and applicable EU SCCs, using Module 2 or 3 according to our role, and UK/Swiss addenda.

7. Anthropic Ireland, Limited

   Claude API

   Sub-processor — we process customer content on instructions

   Selected service — production clearance pending

   Purpose

   The AI half of template migration: reading a document's pages and proposing which text is a variable field, naming those fields, and explaining proposed merges. Deterministic parsing, layout and generation do not use it.

   Data it touches

   Page images used for layout reconstruction and reconstructed template text used for field identification. Anything visible can reach the API. The standard service excludes special-category and criminal-offence data; we do not automatically detect every excluded item. Commercial API terms restrict training use. The published API policy describes deletion within 30 days, with exceptions for agreed terms, longer-retention services, usage-policy enforcement and law; no zero-retention arrangement is claimed.

   Location

   The model is served from the United States. The contracting entity for an EEA customer is Anthropic Ireland, Limited.

   Status

   In use under its commercial API terms. Its data-processing terms do not cover special-category data, so the service excludes it.

   Our relationship

   Sub-processor only, and the narrowest scope on this list: it sees the pages of documents you migrate and nothing else. No account record, billing detail or correspondence reaches it.

   Transfer basis

   Standard Contractual Clauses where applicable — The Commercial Terms incorporate the DPA, with role-dependent EU SCCs and a UK addendum.

8. Okta, Inc. (Auth0)

   Auth0 — identity and sign-in

   Processor to us — we are the controller

   Selected service — production clearance pending

   Purpose

   Authenticates users and issues the tokens the application and API rely on.

   Data it touches

   Email address, the identifier the identity service issues for a user, and sign-in events including IP address and timestamp.

   Location

   Our production tenant is in Okta's EU region (EU-2), under NUTLET SIA's own account, and sign-in runs on our own domain, login.ristmark.app. The contracting company is US-based; international access and onward processing are subject to the DPA.

   Status

   We selected the paid plan on 2026-09-15; its master agreement incorporates Okta's data-processing terms. The production tenant was set up under NUTLET SIA's account on 2026-10-15; it is on the free plan until the paid plan is activated, which must happen before launch.

   Our relationship

   We are the controller of the sign-in records for the people who use your workspace, and this is our processor for them. No document content reaches it.

   Transfer basis

   Standard Contractual Clauses and UK provisions — The paid plan's master agreement incorporates Okta's DPA with EU SCCs and UK transfer provisions. Authorised international access remains possible.

9. Stripe Payments Europe, Limited / Stripe Technology Europe, Limited

   Stripe Checkout, Billing and the customer portal

   Processor to us — we are the controller

   Selected service — production clearance pending

   Purpose

   Takes payment, hosts the checkout and the self-service billing portal, and issues invoices.

   Data it touches

   Billing name and email address, business address, any supplied VAT/registration number, payment-instrument details and transaction records. Card numbers are entered on its own pages and never reach us.

   Location

   Irish contracting entities under the Latvian service agreement; processing and access can include the United States and other countries covered by the applicable transfer terms.

   Status

   The live account, checkout and invoicing must be verified before we charge anyone.

   Our relationship

   We control our customer billing records and remain responsible for invoices and accounting retention. Stripe processes some billing data on our behalf and also acts as an independent controller for its own payment, fraud-prevention and legal purposes under its applicable terms. Your document content is not sent to it.

   Transfer basis

   Incorporated data-transfer terms — The Latvian Services Agreement incorporates the DPA and Data Transfers Addendum, with safeguards applying by role and destination. An Irish counterparty does not eliminate onward transfers.

10. Migadu-Mail GmbH

    Hosted mailboxes for our support and billing addresses

    Both — see below

    In use in the recorded setup

    Purpose

    Receives mail sent to us — support requests, and replies to any transactional message. Anything you write to us is stored in one of its mailboxes.

    Data it touches

    Your email address and whatever the correspondence itself contains, including any attachment you send us.

    Location

    Migadu-Mail GmbH is Swiss. Mailboxes active since 2026-08-18. Its published service description states that its data centres are in France.

    Our relationship

    Both roles can apply: we control administration of support correspondence, while document-content troubleshooting remains processing on the customer's instructions. This mailbox provider handles each class for us. Send only content needed for the support request.

    Transfer basis

    EEA storage and Swiss adequacy — France is within the EEA; relevant Swiss access is covered by Switzerland's adequacy status. Migadu publishes a combined privacy policy/DPA accepted through use. Any non-EEA onward transfer needs its own coverage.

11. Better Stack, Inc.

    Better Stack Telemetry — managed log storage

    Processor to us — we are the controller

    In use in the recorded setup

    Purpose

    Operational logging: the application's own log output is shipped to a managed store so faults can be investigated, support questions answered, and the service watched.

    Data it touches

    Operational events and identifiers, request paths, status and timing. Document bodies are outside intended payloads. Specified personal-data and credential patterns are masked. Logs are kept for 3 days on the plan recorded on 2026-08-25.

    Location

    Better Stack data region eu-central-1a, the region we selected; Better Stack confirmed in writing on 2026-10-19 that our logs and errors are stored in its European region. Its data-processing agreement still permits processing in the United States and other locations. Better Stack, Inc. is a US company incorporated in Delaware.

    Our relationship

    We control security and operational diagnostics. Customer document content and sensitive data are outside authorised telemetry payloads. The provider's schedule excludes sensitive data unless separately agreed. Better Stack gives no advance notice of changes to its own sub-processors and offers no subscription for them (its written reply of 2026-10-19). It lists them, with their locations, in Schedule A of its DPA at betterstack.com/dpa/schedules, under a "Last Updated" date. We check that page ourselves and update this row when a change affects what it says.

    Transfer basis

    Standard Contractual Clauses and UK Addendum — Better Stack, Inc. confirmed in writing on 2026-10-19 that our account's Terms of Use and DPA are with NUTLET SIA, that it does not currently rely on the EU-U.S. Data Privacy Framework, and that restricted transfers rely on the EU Standard Contractual Clauses in Schedule D of its DPA, with the UK Addendum in Schedule E. Its published DPA still mentions the Framework where applicable; we rely on the Clauses.

12. Better Stack, Inc.

    Better Stack error tracking — browser and server exception reports

    Processor to us — we are the controller

    In use in the recorded setup

    Purpose

    Detects and diagnoses browser and API failures.

    Data it touches

    Server and browser error reports contain a scrubbed message/stack, environment and allowlisted identifiers or diagnostic context. Browser reports can include routes, failed requests and controls activated. We minimise document content and redact specified patterns, without promising perfect removal. The provider may add connection IP metadata. Error reports are kept for 90 days on the plan recorded on 2026-08-25.

    Location

    Better Stack data region eu-central-1a, the region we selected; Better Stack confirmed in writing on 2026-10-19 that our logs and errors are stored in its European region. Its data-processing agreement still permits processing in the United States and other locations. Better Stack, Inc. is a US company incorporated in Delaware.

    Our relationship

    We control security and diagnostic processing. Document content and sensitive data are outside authorised telemetry payloads; inadvertent leakage requires containment and deletion assistance. Better Stack gives no advance notice of changes to its own sub-processors and offers no subscription for them (its written reply of 2026-10-19). It lists them, with their locations, in Schedule A of its DPA at betterstack.com/dpa/schedules, under a "Last Updated" date. We check that page ourselves and update this row when a change affects what it says.

    Transfer basis

    Standard Contractual Clauses and UK Addendum — Better Stack, Inc. confirmed in writing on 2026-10-19 that our account's Terms of Use and DPA are with NUTLET SIA, that it does not currently rely on the EU-U.S. Data Privacy Framework, and that restricted transfers rely on the EU Standard Contractual Clauses in Schedule D of its DPA, with the UK Addendum in Schedule E. Its published DPA still mentions the Framework where applicable; we rely on the Clauses.