About this list
A sub-processor is a third party that processes personal data on Sustys’s behalf to help deliver the service. Each is bound by a data processing agreement with terms no less protective than our own DPA, and is chosen to keep your data EU-resident wherever possible.
Pre-launch. This page is still a working draft: it is confirmed with counsel before launch, and the live page will then carry an effective date. What it describes is not aspirational — these are the providers in use, and the data-protection terms named here, including the OCR provider’s zero-retention position, are in force today rather than intended. Anything still marked [review] is verified at that confirmation.
Current sub-processors
- Netcup GmbH
- Application hosting & infrastructure
Germany (EU) - Hostinger
- Marketing-site hosting & pilot application form intake (email, company, country, goods sectors)
EU (Lithuania) - Brevo (Sendinblue)
- Transactional & opt-in email delivery
EU - PostHog (EU Cloud)
- Privacy-first product analytics (consented; session replay off)
EU (Frankfurt) - Mistral AI
- Document OCR — zero data retention on the stateless endpoints we use; documents are sent inline and not stored there, and the training opt-out is enabled
EU (France)
How we change it
Before we add or replace a sub-processor that will process your personal data, we update this page and give advance notice — our intended notice period is 30 days. We keep the list current and versioned, with an effective date, so you can always see who handles your data today and what changed.
Objecting to a change
If you have reasonable data-protection grounds to object to a new sub-processor, tell us at legal@sustys.com within the notice period and we’ll work with you to find a resolution, as set out in the DPA. For how we secure data across these providers, see Security.