Last updated: 8 June 2026
Register updated: 8 June 2026
| Sub-processor | What it processes | Location | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | EU application hosting and compute; personal data in transit (accounts, content, connected-account tokens, AI prompts) | Nuremberg, Germany (EEA) | Processed within the EEA |
| DigitalOcean, LLC (United States) | Managed PostgreSQL (primary database — all stored personal data), Valkey cache and task broker, and object storage (assets and database backups) | Frankfurt, Germany — region fra1 (EEA) | US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses |
| Brevo (Sendinblue SAS, France) | Transactional email — account, billing and service notifications | France (EEA) | Processed within the EEA |
| Google LLC (Vertex AI) | AI processing for the assistant and content generation (customer and end-customer content) | SmashOne-owned Google Cloud project — currently a global processing location | May process outside the EEA — EU-US Data Privacy Framework / Standard Contractual Clauses |
| Cloudflare, Inc. (United States) | DNS, content delivery, reverse proxy and web application firewall (IP addresses, request metadata, data in transit) | Global edge network | US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses |
| Functional Software, Inc. (Sentry, United States) | Application error and performance monitoring, configured with PII minimisation | Sentry EU region (Germany) | US-incorporated provider — Standard Contractual Clauses |
| PostHog, Inc. (United States) | Pseudonymous, server-side product analytics | PostHog EU Cloud | US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses |
| ScrapingBee SAS (France) | Retrieves your public business website so the assistant can build its knowledge base | France (EEA) | Processed within the EEA |
The sub-processors that help run SmashOne — what each does, where it processes data, and the safeguard for any transfer outside the EEA.
SmashOne uses a small number of carefully selected sub-processors to operate the service. The table below lists each one, what it processes, where it processes personal data, and the safeguard for any transfer outside the European Economic Area (EEA). We keep this list current and give customers at least 30 days' notice before we add or replace a sub-processor, as set out in our Data Processing Agreement.
Google LLC (Vertex AI) powers the AI assistant that drafts replies and content. It runs in a SmashOne-owned Google Cloud project that is currently configured with a global processing location, so some processing may take place outside the EEA; those transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. SmashOne and its AI sub-processor do not use your data to train, fine-tune, or improve any general-purpose AI model.
Where a sub-processor is US-incorporated or processes personal data outside the EEA, the transfer relies on the European Commission's EU-US Data Privacy Framework adequacy decision where applicable, or on Standard Contractual Clauses with supplementary technical and organisational safeguards. Payment processing is not engaged yet and will be added to this list when EU billing goes live.
We review this list regularly and update it whenever a sub-processor is added, replaced, or removed. For any change that adds a new sub-processor, we give customers at least 30 days' notice so you can raise a reasonable data-protection objection, as described in our Data Processing Agreement. Questions about sub-processors: info@smashone.ai.
