Subprocessors
The vendors that process personal data on our behalf. All are bound by data processing agreements and security-reviewed before engagement.
Last updated: September 28, 2026
To receive an email notification before we add or replace a subprocessor, contact [email protected].
This page lists the vendors that process personal data in connection with the Compeas platform, this website, and our business operations. For customers, the contractual sub-processor list for the platform is set out in Annex A of the Data Processing Agreement. Vendors listed under "Website & Marketing" process website visitor data only — not customer data from the platform.
Infrastructure
| Vendor | Purpose | Data location |
|---|---|---|
| Ploi Cloud (Ploi BV) | Cloud hosting — application, database, backups | Sweden (EU) |
Service Operations
| Vendor | Purpose | Data location |
|---|---|---|
| Google Workspace (Google Ireland Ltd) | Support email and delivery of website form submissions | European Union |
| AhaSend (AhaSend B.V.) | Transactional email from the platform — notifications, reminders and digests, sent from compeas.com | European Union (EU sending region; servers in Germany, Finland and Bulgaria) |
| Wint (Wint AB) | Billing and payment processing | Sweden (EU) |
Website & Marketing
| Vendor | Purpose | Data location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery and website form processing; the products’ login pages (grc.compeas.com, auditor.compeas.com) and forwarding of Microsoft and Google sign-ins to the customer’s own Compeas address, with nothing stored | Global edge network (European Union for EU visitors) |
| Plausible Insights OÜ | Website analytics (cookieless, consent-based) | European Union |
| Phare (Estonia) | Uptime monitoring and public status page | European Union |
Changes to this list are announced at least 30 days before a new subprocessor begins processing customer data, as described in the Data Processing Agreement. Questions: [email protected].