Our sub-processors
Last reviewed: October 2026
In compliance with the GDPR, Kardu publishes the list of sub-processors that process personal data of our clients on the platform. It is the same list set out in our Data Processing Agreement and is updated automatically from it.
| Provider | Role | Data processed | Location and safeguards | Policy |
|---|---|---|---|---|
| Supabase, Inc.Pending confirmation | Database, authentication and file storage | All Customer account and compliance data, uploaded evidence files | EU (Frankfurt, Germany)Data hosted in the EU; US entity: Standard Contractual Clauses for any remote access | View → |
| Vercel, Inc.Pending confirmation | Application hosting and delivery | Request data in transit, IP addresses and technical logs | EU (Frankfurt, fra1)Data processed in the EU; US entity: Standard Contractual Clauses for any remote access | View → |
| Scaleway SAS | Transactional email delivery | Recipient name and email address, email content | EU (Paris, France)EU — no transfer | View → |
| Mistral AI SAS | AI-assisted features (assistant chat, questionnaire answers, suggestions) | Text the user submits to AI features, including assistant chat messages, questions received in client questionnaires and processing-register entries. Uploaded document contents are never sent. | EU (France), as stated by the providerEU — no transfer; Mistral AI data processing addendum accepted with its terms of service. Use of API data to train Mistral models is disabled on Kardu’s account. | View → |
| Upstash, Inc.Pending confirmation | Rate limiting and account lockout protection | IP addresses and login email addresses, held temporarily | EU (Frankfurt, Germany — AWS eu-central-1)Data hosted in the EU; US entity: Standard Contractual Clauses for any remote access | View → |
| Stripe Payments Europe, Ltd.Pending confirmation | Payment processing | Organisation name, billing contact email, payment details | EU (Ireland), with onward processing by Stripe group companiesStandard Contractual Clauses for transfers within the Stripe group | View → |
| PostHog, Inc.Pending confirmation | Product analytics, only with the user’s consent; error monitoring | Analytics: pseudonymous user ID, plan, sector and in-app events. Error monitoring: error message, stack trace and the page or route where it happened — never request contents, cookies or headers; browser errors only with consent. No names or email addresses. | EU (eu.posthog.com)Data hosted in the EU; US entity: Standard Contractual Clauses for any remote access | View → |
| Intuition Machines, Inc. (hCaptcha)Pending confirmation | Bot protection on login, registration and password reset | IP address and browser/device signals | United StatesStandard Contractual Clauses — pending confirmation | View → |
| Cloudmersive, LLCPending confirmation | Malware scanning of uploaded evidence files | Full content of each uploaded file | Canada (Beauharnois, Quebec); legal entity in the United StatesEU adequacy decision for Canada; data processing agreement pending confirmation | View → |
Exceptions to our EU data residency policy: Intuition Machines, Inc. (hCaptcha) and Cloudmersive, LLC. Their transfer safeguards are shown in the table; those marked as pending will be updated as soon as they are signed.
We will notify our clients at least 30 days in advance before adding or changing any sub-processor. To receive these notifications, make sure you have product communications enabled in your account.
The contractual reference document is our Data Processing Agreement (DPA). For any questions about our sub-processors, write to us at privacy@kardu.eu.
This list covers our clients’ data on the platform. The providers we use on this website (call booking, visitor analytics) are listed in our privacy policy.