Subprocessors

Last updated: 17 May 2026

When Sentink SaaS-hosted programmes process respondent or workspace data via vendors, contractually cascading obligations apply beneath our Data Processing Agreement (see DPA).

Snapshot table (living document)

Vendor	Typical role today	Locations / posture	References
Sentink dedicated infrastructure	Hosting, backups, and networking for Sentink Cloud run on Sentink-managed dedicated servers in Germany (not multi-tenant public-cloud compute for core application workloads)	Germany — site and redundancy details under order / security annex	Operational security commitments • contractual DPA-aligned controls
Stripe	Cardholder data vaulting under PCI scope when you buy licences online	Stripe global PoPs	SCC modules • Stripe DPA • PCI DSS
Anthropic	Cloud inference for optional AI-assisted features	Principally United States exposures unless enterprise routing restricts	SCCs • no-training rider text (per order)
OpenAI	Cloud inference for optional AI-assisted features	Principally United States unless locked-down SKU applies	SCCs • no-training wording (commercial schedule)
Google (Gemini / Google AI APIs)	Cloud inference for optional AI-assisted features	US / EU and other regions depending on product and tenancy configuration	SCCs • DPA / Google Cloud terms • no-training assurances where contractually scoped
SendGrid / Postmark class ESPs	Transactional SMTP transport	Principally United States relays	SCC + technical supplement
Google Workspace collaboration	Controlled staff mail/docs	Mixed EU/US depending on SKU	SCCs • DPA
Plausible (self-host or Cloud) reference architecture	Lightweight marketing analytics respecting consent	Frequently EU infra	Lightweight DPA & configuration notes
Calendly / Crisp-class widgets	Scheduling & chat overlays when surfaced	Mostly US-hosted embeds invoking separate privacy statements	SCC / vendor-specific
Miscellaneous observability exporters	Incident detection & infra metrics narrowly scoped	Configurable geography	Operational security review

Treat this page as illustrative — customers receive email notice ≥ 30 calendar days before material new respondent-data subprocessors onboard absent narrow security carve-outs enumerated in Exhibit D of negotiated contracts.

Enterprise Private installations often avoid SaaS-listed subprocessors for payload paths because compute stays on your tenancy—your procurement annex supersedes any generic marketing summary.

Operational questions: [email protected]

Latest PDF export may be circulated under NDA RFP engagements.