Valevia — Sub-Processor Register
Last updated: 7 November 2026
Living document, published at platform.valevia.eu/dpa/sub-processors (DPA §5.1). Under our DPA (§5.3), Clients are notified at least 30 days before a sub-processor is added or replaced, by email to the account owner and in the Service, and may object; a feature that relies on a new sub-processor processes a Client's data only once that period has ended without the Client's objection, or earlier where the Client's account owner agreed in writing.
1. Platform Sub-Processors
Providers that process personal data to deliver the Valevia platform.
| # | Sub-Processor | Legal Entity | Processing Location | Purpose | Data Categories | Transfer Mechanism |
|---|---|---|---|---|---|---|
| 1 | Microsoft Azure (incl. Azure OpenAI Service) | Microsoft Ireland Operations Ltd | EU — Azure West Europe (primary); some AI workloads in France Central / Sweden Central | Hosting, storage, databases, networking, key management; AI inference (text generation, classification, image analysis, speech-to-text transcription of dictation and voice notes) | All platform data; property text & images; redacted email content; a user's own voice recording for transcription (deleted once transcribed, never stored — DPA Schedule B, purpose B2) | EEA (EU data-boundary commitment) |
| 2 | Stripe | Stripe Payments Europe Ltd | EU (Ireland); US backup | Subscription billing, invoicing, payment methods | Name, email, billing address, payment method (PCI-DSS) | EEA; SCCs/DPF for US backup |
| 3 | Resend | Plus Five Five, Inc. (San Francisco; trades as Resend) | US | Transactional & service email (notifications, account, replies) | Recipient email address, message content | SCCs / DPF |
| 4 | Twilio | Twilio Ireland Limited (contracting entity for EEA customers; Twilio Inc., US, is the SCC data importer) | US | SMS / WhatsApp notifications to agency staff | Staff phone number, notification content | SCCs / DPF |
| 5 | Zernio (formerly Late) | Zernio | US | Publishing Client-approved content to connected social accounts | Marketing images/video, captions, connected-account tokens | SCCs |
| 6 | PostHog | PostHog, Inc. (EU Cloud) | EU (Frankfurt — eu.i.posthog.com) | Product analytics: consent-gated in the browser; key-action events from our servers (legitimate interest) | Pseudonymous user ID, agency, role, tier, page interactions (browser, with consent); key-action events (server) — no name, email address or content | EEA |
| 7 | Sentry | Functional Software, Inc. | EU data region (ingest.de.sentry.io) | Error monitoring (strictly necessary, always on); performance tracing (analytics-consent-gated) | Error/diagnostic data; PII scrubbed before send; no IP address or user identifiers attached | EEA; SCCs for US support access |
| 8 | HubSpot | HubSpot, Inc. | US | Our sales & customer-relationship records (incl. contact-form enquiries) | Business contact name, email, company, lifecycle stage | SCCs / DPF |
| 9 | Didit | Didit Identity Spain, S.L. (Barcelona; parent Didit Identity, Inc., US) | EEA (Didit's European infrastructure); its screening provider ComplyAdvantage in the EEA and the UK | PEP screening of the parties in a deal file's AML part, on the agent's run; the request is not stored by Didit | Party name, person/company, a full date of birth when the agent types one | EEA; UK adequacy decision for the screening provider; SCCs for any other transfer (Didit DPA, Annex 2 of its Business Terms) |
| 10 | Slack — ⚠️ notified to Clients on the date of the notice (DPA §5.3); in effect 30 days after it. Free plan, US hosting, DPF + SCCs and 90-day retention settled by the founder 2026-11-05; DPA in force by use of the service (MSA incorporates the DPA by reference) | salesforce.com Germany GmbH (per the Salesforce MSA, customer domiciled in Germany) | US (Free plan: no EU data residency) | Support communications: each request an agency sends to the Valevia team (« ? » → « Demandes ») is posted in one channel of Valevia's workspace, where the Valevia team answers it in a thread | The request's words, with e-mail addresses, phone numbers, IBANs and ID numbers masked (they can still name the agency's clients); its type, page and browser; the agency; the sender's first name; the agency's later replies; a link to Valevia's admin page. Never a film, capture, photo or file, nor a link to one — those stay in Microsoft Azure (EU). Kept 90 days (workspace-wide retention, Free plan — founder 2026-11-05); a deleted request's messages are deleted sooner by the app | EU-US Data Privacy Framework (Slack participates through Salesforce; UK and Swiss extensions) + EU/UK SCCs in Slack's DPA |
| 11 | Openapi | Openapi (Italy) | EU — Google Cloud europe-west1, Belgium (Openapi DPA v4.0, 2026-09-30); Openapi's own sub-processors are named in its DPA | Simple electronic signature of a document the Client's agent sends for signature — a document of the transaction, or the AML client declaration (the form only, never an identity document) — with a code sent to each signer by text message or email; it returns each signer's link and, once signed, the signed document and its signing record (DPA Schedule B, purposes B3 and B4) | The document sent; each signer's name, email address and mobile number; the signing record (who signed, when, from which connection, the code checks), which Openapi keeps 10 years as evidence of the signature | EEA — no transfer |
| 12 | Meta (WhatsApp Business Platform) — ⚠️ notified to Clients on the date of the notice (DPA §5.3); in effect 30 days after it, or earlier on the account owner's written « OK ». Used for a Client only when its account owner switches WhatsApp on and a number the agency owns is connected — never an employee's personal WhatsApp | WhatsApp Ireland Limited (contracting entity for the European Region; processor under the WhatsApp Business Data Processing Terms); the Cloud API is hosted by Meta | Meta's data centres, including the US. Where Cloud API local storage can be set on the connected number, message content at rest stays in the EU (Germany), and leaves it only while a message is delivered, up to 60 minutes; limited metadata tokenised and encrypted. Per Meta's docs it cannot be set on a number kept on the WhatsApp Business app (coexistence) — see vendor-dpas.md, Meta, item 4a | Receiving and sending the WhatsApp messages of the number the agency connected, so they arrive in the Inbox like mail and the agent answers them from Valevia (DPA Schedule B, purpose B1) | The messages on that number — text, photos, voice messages, documents; the phone numbers and profile names of the agency and of the people writing to it; time and delivery status of each message. Meta keeps messages at most 30 days to deliver them | EU-US Data Privacy Framework (WhatsApp LLC and Meta Platforms, Inc. certified; Meta Platforms, Inc. active on the DPF list, read 2026-11-07), per WhatsApp's Business Data Transfer Addendum; processor-to-processor SCCs reserved by WhatsApp as the alternative |
2. Conditional Sub-Processors (only if a Client enables the feature)
| Sub-Processor | Condition | Purpose | Data Categories |
|---|---|---|---|
| Meta (Facebook / Instagram / WhatsApp) | Client connects social publishing | Publish approved marketing assets; WhatsApp distribution (the live WhatsApp Business inbox is item 12) | Images/video, captions, recipient numbers (WhatsApp) |
| Client connects social publishing | Publish approved marketing assets | Images/video, captions | |
| The agency's CRM | Client enables CRM integration — off by default | Sync approved listings / pull property context | Listings, agent & prospect contact details |
Publishing to the platforms above is carried out through Zernio (item 5). CRM integration is disabled by default and is not active unless a Client configures it.
3. Valevia's Own Marketing / Outreach (Valevia as controller)
These providers support Valevia's own B2B outreach. They do not process Client end-user data.
| Sub-Processor | Purpose | Data Categories |
|---|---|---|
| Woodpecker | Cold-email campaign delivery and tracking | Prospect business email, name, company |
| Jina AI | Extracting publicly available business web content for outreach research | Public business website content / URLs |
| HubSpot | Prospect & pipeline records (see item 8) | Business contact details, engagement |
| Resend | Transactional replies (e.g. demo, welcome) | Recipient email, message content |
| Verifalia (Cobisi Research, Vigonza/IT; processes in the EEA — DE/NL per DPA Art. 13.1) — ⚠️ the only verifier since 2026-10-21 (the self-hosted prober was retired); gated off with the same activity until LIA §2.6 / DPIA §13 are counsel-signed. DPA in force (incorporated into Verifalia's ToS, 15 Jan 2026); Verifalia's own sub-processors: Hetzner + AWS (EEA) | Email-address verification only; never used as an email finder/enrichment | Prospect business email address (single check) |
4. Self-Hosted Services (not third-party sub-processors)
Run within Valevia's own Azure (EU) infrastructure, no external data processing: the Valevia automation engine (workflow orchestration; it replaced n8n in July 2026), Remotion (render service), the document converter (open-source LibreOffice behind Gotenberg; turns a filled Word document into a PDF before it is sent for signature — internal only, no public endpoint), Metering Gateway, Event Collector, Review Dashboard, ROI Dashboard, PostgreSQL, Redis.
5. Cross-border data flow — Australian customers (APP 8)
For an Australian agency Client, this register doubles as the APP 8 disclosure aid: it lets the Client (the APP entity) satisfy itself about the overseas recipients before it discloses personal information to us.
- Where AU data is processed. All Client and end-user personal information — agency/user records, property and owner/vendor data, and (for the Inbox product) email content — is stored and processed in the European Union (Microsoft Azure, EU regions — West Europe, France Central) by the platform sub-processors in §1. We do not store Australian data in Australia.
- Nature of the flow. By using the service, the Australian Client discloses personal information to Valevia Consulting UG (a German company) as an overseas recipient under APP 8. We handle it to EU GDPR standards and take reasonable steps to ensure our sub-processors do likewise (DPA Schedule D, §D.2).
- Onward transfers. A few §1 sub-processors process outside the EEA (Stripe's US backup, Resend, Twilio, Zernio, HubSpot — US) under SCCs / the EU-US Data Privacy Framework; the mechanism per provider is in the §1 table. These are the same across all markets.
- What this does and doesn't do. It supports the Client's APP 8 accountability; it does not by itself discharge the Client's own obligations. See Privacy Policy §14 and DPA Schedule D.
- Australian data residency. Not offered today (EU-only). Available as a future option (Azure Australia East) if a Client requires it.
6. Change Log
| Date | Change |
|---|---|
| 2026-11-07 | Added Meta (WhatsApp Business Platform; WhatsApp Ireland Limited) under §1 — the live WhatsApp inbox on a number the agency owns (PLAN-whatsapp-live). Used for a Client only when its account owner switches WhatsApp on and connects such a number, and only from 30 days after the notice to its account owner, unless it objects, or earlier on its written « OK » (DPA §5.3). Message content in Meta's data centres, including the US; kept at rest in the EU (Cloud API local storage, Germany) only where it can be set on the number — per Meta's docs not on a coexistence number — and then up to 60 minutes outside the EU while a message is delivered; transfer on the EU-US Data Privacy Framework. Facts and sources: vendor-dpas.md, Meta row (read 2026-11-07). The §2 Meta row (social publishing through Zernio) is unchanged. |
| 2026-11-06 | Added Openapi (Italy; hosting in the EU, Belgium) under §1 — electronic signature of the documents a Client's agent sends for signature. Used for a Client only from 30 days after the notice to its account owner, unless it objects (DPA §5.3). Added the self-hosted document converter under §4. The register is now published at platform.valevia.eu/dpa/sub-processors. |
| 2026-11-05 | Corrected the legal entities of Resend (Plus Five Five, Inc.) and Twilio (Twilio Ireland Limited for EEA customers) from each vendor's DPA. How each vendor's DPA binds us is now recorded in vendor-dpas.md. |
| 2026-11-05 | Added Slack under §1 — support communications (PLAN-client-requests, D2). It closes an existing gap: the former « Help & Support » form already sent reports to a Slack webhook without a row here. Notified to Clients 30 days ahead (DPA §5.3). GitHub is not added: an issue opened from a request carries its reference, type, page, browser, the agency's slug and a title the founder types — no words of the request, no file (D4) — so GitHub processes no Client data. Same day, founder: Free plan — workspace-wide retention 90 days, US hosting, transfer on DPF + SCCs. Contracting entity: salesforce.com Germany GmbH (per the Salesforce MSA, customer domiciled in Germany); Slack's DPA in force by use of the service (MSA incorporates the DPA by reference). |
| 2026-10-21 | Removed Scaleway from §3. The self-hosted email-verification prober it hosted (open-source Reacher) was retired: the server and its IPs were deleted and the app no longer calls it. Verifalia is again the only verifier. |
| 2026-10-13 | Added Didit (Didit Identity Spain, S.L., Barcelona; EEA processing) under §1 — PEP screening of the AML parties of a deal file, used only for a Client that accepted the 2026-10-13 agreement. DPA in force (Annex 2 of Didit's Business Terms). |
| 2026-07-14 | Added Scaleway (Paris/FR, EEA) under §3 as the IaaS host for a self-hosted email-verification prober (open-source Reacher, SMTP RCPT-TO) — now the primary verifier; Verifalia demoted to fallback (re-checks greylisted unknowns only). Reflects live implementation; the verification activity remains counsel-gated (LIA §2.6 / DPIA §13). Transfers unaffected — Scaleway is EEA. |
| 2026-06-29 | Added Verifalia (Cobisi Research, IT; processing in the EEA — DE/NL) under §3 outreach — email-address verification only for owner-email construction. DPA in force (incorporated into Verifalia's ToS); listed gated/not active until LIA §2.6 / DPIA §13 are counsel-signed. |
| 2026-05-29 | Reconciled against live systems: added Sentry, Twilio, HubSpot, Zernio (formerly Late), Jina, Woodpecker; removed Creatomate, Lemlist/Instantly, Calendly and Backblaze B2 (not used); corrected AI region detail; moved social platforms under Zernio. |
| 2026-02-22 | Initial register created. |
Notes
- Clients receive at least 30 days' notice of an added or replaced sub-processor per DPA §5.3 and may object.
- How each vendor's DPA binds us (terms, console or signature), with its proof:
vendor-dpas.md. - GitHub (Valevia's code and issue tracker) is not a sub-processor: it receives no Client data (see the 2026-11-05 change).
- This register is published at platform.valevia.eu/dpa/sub-processors and linked from the DPA and the Privacy Policy.