Owlpane / Sub-processors

Sub-processors

Draft, not in force. This page was drafted by an AI assistant from what the software does. It has not been reviewed by a lawyer and the company data is incomplete (address, firmenbuchNumber, registerCourt, vatId, managingDirectors, registered). It is hidden from search engines until the data in scripts/site/config.mjs is complete. Highlighted [brackets] need your input.

Service providers that may process personal data on our behalf. Customer-configured notification targets (Slack, PagerDuty, Opsgenie, Jira, ServiceNow, email, webhooks) are chosen and controlled by the customer and are not our sub-processors. We will list changes here [and notify DPA customers 30 days in advance].

Provider	Purpose	Data	Location	Transfer basis
Hosting provider for the Owlpane service cell(s)	Runs the ingest gateway, API, databases and storage for customer telemetry and account data	Everything a customer sends or stores in Owlpane	EU: [provider, region: confirm on the live cell]	None if hosted in the EU by an EU-established provider [confirm]
Amazon Web Services (AWS Amplify and CDN)	Hosts the website and the console web app	IP address and request metadata of visitors; no telemetry	[confirm Amplify region; the CDN serves from many locations]	[EU-US Data Privacy Framework / SCCs, confirm with AWS terms]
Stripe Payments Europe, Ltd.	Billing and payment processing for paid plans	Billing contact, company and VAT details, payment method (card data goes to Stripe, not to us)	EU (Ireland) and the US	Stripe DPA with SCCs [confirm]
Resend	Sends transactional email (sign-up confirmation, sign-in links, alert emails)	Recipient email address and message content	[confirm region; Resend offers EU and US]	[SCCs / DPF, confirm]
Anthropic, PBC and OpenAI (only if the AI features are enabled for the workspace)	Answers AI search questions and generates AI summaries in the console	The sentence a user types and the names of searchable attributes; no telemetry values (the console says so next to each AI result)	United States	SCCs / DPF [confirm]. Customer data is not to be used to train models: confirm in the provider terms. [Confirm which providers are actually used; OpenAI appears only as a dependency in the code]
S3-compatible object storage	Encrypted backups and customer-requested data exports	Backups of the databases; export files	[provider, region: confirm]	[confirm]

Last updated: [date].