Subprocessors
Last Updated: 22/07/2026
Final — pending counsel review. This list was verified on 22/07/2026 and, together with our Data Processing Agreement, becomes contractually effective on completion of review by external legal counsel.
Zephyra (QTool SRL) uses the third-party providers below. We notify customers at least thirty days in advance of any addition or replacement of a sub-processor per our DPA.
Sub-processors of Customer Data
These providers process Customer Personal Data — personal data contained in the data customers and their users upload to or generate within the Services — on our customers’ behalf. This list is maintained per clause 6 of the DPA; transfer safeguards are recorded in the DPA’s Annex 4.
| Provider | Purpose | Region | Transfer safeguard |
|---|---|---|---|
| Google Cloud Platform | Hosting of the product (app.zephyra.tech) and websites, compute, storage, CDN, load balancing | EU (Netherlands / europe-west4), with global CDN edge locations | EU primary; Google LLC is EU–US DPF-certified for edge flows, SCCs in the Google Cloud DPA as fallback |
| Microsoft | Single sign-on / identity (Entra ID); transactional and operational email (Microsoft 365 / Microsoft Graph); in-app calling and chat (Azure Communication Services); desktop-release distribution (Azure Blob Storage) | US / global | Microsoft Corporation is EU–US DPF-certified, SCCs in the Microsoft DPA as fallback |
| Google (Gemini API) | AI-assisted analysis, chat, and drawing review. When a user invokes an AI-assisted feature, the submitted prompt and relevant project context are sent to the Gemini API (DPA clause 3.4). Per Google’s applicable paid-services terms, submitted content is not used to train or improve Google’s models | US / global | Google LLC is EU–US DPF-certified, SCCs as fallback |
| SendGrid (Twilio) | Transactional email (account activation, invitations, notifications) | US | Twilio Inc. is EU–US DPF-certified, SCCs in the Twilio DPA as fallback |
| Sentry (Functional Software, Inc.) | Application error and performance monitoring | EU (Frankfurt ingest) | EU data residency; SCCs in the Sentry DPA for residual US support access |
Zephyra’s proprietary machine-learning features (physics surrogates, costing and manufacturing-time prediction) run on our own Google Cloud infrastructure in the EU — or on the customer’s own infrastructure where deployed on-premise — and involve no additional third-party provider. Models trained for a customer organization are trained on that organization’s data and serve only that organization (DPA clause 3.5).
Zephyra’s own service providers
These providers support Zephyra’s own business operations (billing, CRM, website analytics, consent management). For this processing Zephyra acts as an independent controller under its Privacy Policy; it is outside the scope of the DPA (clause 2.2) and listed here for transparency.
| Provider | Purpose | Region |
|---|---|---|
| Stripe | Subscription billing, payment processing, invoicing (payment card data is handled by Stripe, not stored by Zephyra) | US (EU entity for EU merchants) |
| HubSpot | CRM for website contact-form inquiries | US |
| Zoho | CRM for customer accounts and product lifecycle events (registrations, subscriptions) | EU data centre |
| Google Analytics 4 / Google Tag Manager | Website analytics (consent-gated via our cookie banner) and in-platform product analytics | US / global |
| Cloudflare | Bot protection (Turnstile) on website forms | Global edge |
| Cookiebot (Usercentrics) | Cookie-consent management on the website | EU (Denmark) |
International transfers
Where personal data leaves the EEA, we rely on safeguards under Chapter V GDPR: the EU–US Data Privacy Framework where a recipient’s certification is current (verifiable on the official DPF list), with EU Standard Contractual Clauses incorporated in each provider’s data-processing addendum as fallback. Details per recipient are recorded in Annex 4 of the DPA; certification status is reviewed at each provider’s annual recertification.
Changes
When we add or replace a subprocessor, we update this list at least thirty days in advance and notify customers per the DPA.
For questions about subprocessors or to raise an objection per your DPA, contact privacy@zephyra.tech.