Sub-processors
Last updated: September 2026
In compliance with Article 28 of the GDPR, Kardu publishes the list of sub-processors that have access to personal data of our clients. Most are located within the European Union or the European Economic Area; the two only exceptions are documented below, both with a Data Processing Agreement (DPA) in place.
| Provider | Category | Location | Purpose | Policy |
|---|---|---|---|---|
| Supabase | Database and authentication | Frankfurt, EU (AWS eu-central-1) | Platform data storage, user authentication and session management. | View → |
| Vercel | Infrastructure and hosting | Frankfurt, EU | Web application hosting and static content delivery. | View → |
| Scaleway SAS | Email communications | París, EU | Sending transactional emails (confirmations, alerts, evidence reminders). | View → |
| Stripe | Payment processing | Irlanda, EU | Secure payment processing for subscription plans. Only accesses billing data. | View → |
| PostHog | Web analytics | European Union (EU instance) | Aggregated, anonymous website usage analytics (page views, scroll, click heatmaps and Core Web Vitals). Activated only with consent. Does not identify visitors or access platform customer data. | View → |
| hCaptcha (Intuition Machines, Inc.) | Anti-bot protection | Miami, USA (exception — outside the EU) | Anti-bot protection on the login and registration forms. Documented exception to our EU data residency policy, with a Data Processing Agreement (DPA) in place. | View → |
| Cloudmersive | File malware scanning | Free tier via Beauharnois, Quebec, Canada (PIPEDA adequacy) — legal HQ in Pleasanton, California, USA | Malware scanning of files uploaded to the Evidence Vault. Documented exception to our EU data residency policy, with a Data Processing Agreement (DPA) in place. | View → |
hCaptcha and Cloudmersive are the two only exceptions to our EU data residency policy. Both have a Data Processing Agreement (DPA) in place and equivalent contractual safeguards (standard contractual clauses / PIPEDA adequacy in Cloudmersive's case).
We will notify our clients at least 14 days in advance before adding or changing any sub-processor. To receive these notifications, make sure you have product communications enabled in your account.
For any questions about our sub-processors, write to us at contact@kardu.eu.