Subprocessors and International Transfers

Effective date: March 25, 2026 · Last updated: April 3, 2026

This page lists subprocessors used to provide Emvara. Emvara infrastructure is primarily hosted in the United States, and personal data may be transferred to or accessed from the United States. Where required by GDPR/UK GDPR/Swiss data protection law, we rely on recognized transfer mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework (and UK/Swiss extensions where applicable), and/or Standard Contractual Clauses (SCCs) with supplementary safeguards.

Current Subprocessors

• DigitalOcean (hosting and infrastructure). Transfer terms: DigitalOcean DPA.
• AWS (Amazon S3) (object storage and cloud services). Transfer terms: AWS DPA.
• Microsoft Azure (including Azure OpenAI Service) (AI model hosting/inference). Transfer terms: Microsoft Products and Services DPA.
• Sentry (error monitoring and diagnostics). Transfer terms: Sentry DPA.
• Proton (email communications). Transfer terms: Proton DPA.
• hCaptcha (Intuition Machines, Inc.) (anti-spam verification, consent-gated). Transfer terms: hCaptcha DPA.

How We Use Transfer Mechanisms

We put processor terms in place with our subprocessors. Depending on the service and destination country, these terms may rely on an adequacy decision (including the EU-U.S. Data Privacy Framework) and/or SCCs under EU Commission Implementing Decision (EU) 2021/914 (including UK and Swiss transfer addenda where required).

Subprocessor Change Notifications

We update this page at least 15 days before authorizing a new subprocessor. To receive email notifications of subprocessor changes, email [email protected] with the subject line “Subscribe: Subprocessor Changes.” See our Data Processing Agreement for the objection process.

If you need a signed DPA for your organization, see our Data Processing Agreement.