Legal
Sub-processors
Where we process customer data as a processor, these are the vendors involved. Each is engaged under a written contract meeting Article 28 of the GDPR, and each is bound to the same obligations we owe our customers.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, container runtime, managed PostgreSQL, key management | EU (customer-selected region) | No transfer outside the EEA when an EU region is selected |
| Microsoft 365 / Entra ID | Single sign-on and outbound mail via Microsoft Graph | EU / global | EU Data Boundary; Standard Contractual Clauses where applicable |
| Stripe | Subscription payments and billing for the Timetrackr service | EU / US | Standard Contractual Clauses; EU-US Data Privacy Framework |
| OpenAI | Optional AI features, only when the customer selects OpenAI as provider | US | Standard Contractual Clauses. Not used in local-model mode. |
| Anthropic | Optional AI features, only when the customer selects Anthropic as provider | US | Standard Contractual Clauses. Not used in local-model mode. |
| Freshworks / Freshservice | Read-only import of tickets and contacts, only if the customer connects it | EU / US | Customer-controlled integration; data flows into Timetrackr only |
Which ones actually apply to you
Several entries are conditional rather than universal. AI providers are used only if you choose a hosted model — select a local model and neither OpenAI nor Anthropic receives anything. Helpdesk vendors appear only if you connect that integration. A deployment pinned to an EU region with local AI involves no transfer outside the EEA.
Changes
We notify customers by email before adding or replacing a sub-processor, so that there is a reasonable opportunity to object under the Data Processing Agreement. To be added to that notification list, write to privacy@timetrackr.it.
Data Processing Agreement
A DPA including the Standard Contractual Clauses is available on request and is signed as part of onboarding. Request a copy at privacy@timetrackr.it, or read the Privacy Policy for how the roles divide.