Sub-processor list

Third parties that process customer data on behalf of Responsemate ApS

Last updated: 16 October 2026. This list is Appendix B of Responsemate's Data Processing Agreement in stand-alone form. Customers are notified by e-mail at least 30 days before a sub-processor is added or replaced (60 days for the AI model provider that processes customer content) and may object as described in the Data Processing Agreement.

1. Sub-processors

Sub-processor	Entity and address	What it does for the Service	Where the data is processed	Assurance
DigitalOcean	DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA	Hosts the application and the background worker (App Platform) and the managed job queue (Valkey). All data in the Service passes through these servers.	EU/EEA, currently Amsterdam, the Netherlands	SOC 2 type II, ISO/IEC 27001; DPA with SCCs
Cloudflare (engaged by DigitalOcean)	Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA	DigitalOcean App Platform's content-delivery and TLS edge: every request to the Service passes through Cloudflare's network in transit before it reaches the application. Sets the strictly necessary cookie `__cf_bm` (bot protection, 30 minutes). Stores no content of the Service.	EU points of presence for EU visitors (currently Copenhagen); US entity	ISO/IEC 27001, 27701, SOC 2 type II; EU-US Data Privacy Framework; DigitalOcean's SCCs
MongoDB Atlas	MongoDB Limited, Building Two, Number One Ballsbridge, Dublin 4, Ireland	Primary database: user accounts, knowledge base text and embeddings, questionnaires and answers, activity and AI logs, backups.	EU/EEA, currently Stockholm, Sweden (AWS eu-north-1)	SOC 2 type II, ISO/IEC 27001, 27017, 27018, 27701; DPA with SCCs
Amazon Web Services	Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg	Stores uploaded files (Amazon S3) and performs OCR of scanned documents (Amazon Textract).	S3: Stockholm, Sweden (eu-north-1). Textract: Dublin, Ireland (eu-west-1).	SOC 1/2/3, ISO/IEC 27001, 27017, 27018, 27701, C5; DPA with SCCs
OpenAI	OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland	Fallback AI provider, used only for a workspace that has not connected an AI provider of its own: drafts answers, summaries, classifications, chat replies and embeddings from the excerpts the Service sends, and transcribes voice recordings a user dictates to the assistant (the recording is transcribed and discarded). Processing only: API data is not used for training and nothing is stored beyond abuse monitoring (up to 30 days); the workspace's content stays in the EU.	United States, transient processing only	SOC 2 type II; EU–US Data Privacy Framework (OpenAI, L.L.C.); DPA with SCCs
Scaleway	Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France	Sends transactional e-mail (invitations, password resets).	Paris, France (fr-par)	ISO/IEC 27001, HDS; DPA
Sentry	Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA	Error and performance monitoring. An error event carries the signed-in user's id, the workspace name and the URL of the failing request; no name and no e-mail address. Browser replays mask all text and media. The monitoring script is served from the Service's own address.	EU data residency, Frankfurt, Germany	SOC 2 type II, ISO/IEC 27001; DPA with SCCs

2. Integrations the customer controls

These services receive data only when a workspace administrator enables the integration, and under the customer's own agreement with the provider. They are not sub-processors of Responsemate.

Service	When data flows	What flows
Microsoft Entra ID	The customer turns on single sign-on.	Sign-in identity, name, e-mail, profile photo of the customer's users.
Microsoft SharePoint (Microsoft Graph)	The customer connects a SharePoint site or library.	Documents the customer chooses to sync into the knowledge base.
Slack	The customer installs the Slack app.	User directory for matching accounts; questions and answers the customer's users send through the bot.
Google Forms, Microsoft Forms	A user asks the Service to read a public web form.	The form's questions (read from the public form address the user supplies).
Customer's own AI provider (OpenAI, Anthropic, Azure OpenAI, Google, Mistral, Amazon Bedrock)	An administrator enters the customer's own API key.	The same excerpts and prompts that would otherwise go to Responsemate's default provider, and voice recordings for transcription where the provider can transcribe speech.
A second provider for voice input only (OpenAI, Azure OpenAI, Mistral or Google)	An administrator whose chat provider cannot transcribe speech (Anthropic, Amazon Bedrock) chooses one on the AI configuration tab, with the customer's own key.	Voice recordings a user dictates to the assistant; transcribed and discarded.

3. Services that receive no personal data

Service	What it receives
logo.dev	Company names and company domain names, to find and display company logos for clients and vendors.
Public websites	The Service fetches public pages when a user runs a vendor scan or checks the links in the knowledge base. No customer data is sent.

4. Responsemate's own personnel

Responsemate ApS is a Danish company. Its personnel work from Denmark and access customer data only when needed for support, operations or incident response, under written confidentiality obligations and with multi-factor authentication at every provider console.

5. Change history

Date	Change
14 October 2026	First published version.
15 October 2026	Processing locations stated for DigitalOcean and MongoDB Atlas; OpenAI described as the fallback provider with transient processing.
15 October 2026	DigitalOcean's location corrected to Amsterdam, read from the hosting account.
16 October 2026	Cloudflare added as DigitalOcean's content-delivery and TLS edge; voice recordings named in the OpenAI row and the customer-provider rows; the Sentry row says what an error event carries (id, workspace, URL; no name or e-mail); logo.dev receives company names as well as domain names.