Sub-processors

Sub-processors and data location

The third parties that may process customer data for YARDtwin: what each one does, where it does it, and the safeguard for any transfer outside the European Economic Area (EEA).

Last updated: 12 October 2026

1. Current sub-processors

Each provider below acts under a data processing agreement with YARDtwin. Some receive data only when a customer uses the feature concerned; the purpose column says so.

Provider	Purpose	Location	Transfer safeguard
Microsoft Azure	Hosting, database and file storage	EEA — Sweden Central and Norway East (geo-redundant copy of uploaded files in Norway West)	Microsoft Products and Services DPA; data stays in the EEA
Anthropic	AI reading of driver licences and documents (on by default; a site administrator can switch it off), one-to-one comparison of a driver’s gate photo with the licence or stored driver photo (off by default; a site administrator can switch it on or off), and the in-app assistant	USA	Standard Contractual Clauses and a transfer impact assessment (not certified under the EU-US Data Privacy Framework); API data is not used for model training and is deleted within 30 days under Anthropic’s standard commercial terms
Resend	Transactional e-mail	USA	Standard Contractual Clauses (its EU-US Data Privacy Framework re-certification is under review)
Stripe	Billing contact and payment data (YARDtwin stores no card numbers)	EU / USA	Standard Contractual Clauses; PCI DSS Level 1
Twilio	SMS and WhatsApp notifications (only if the customer enables them)	USA	Standard Contractual Clauses
Google and Microsoft	Sign-in identity data (only if the customer uses those sign-in options)	EU / USA	Standard Contractual Clauses / EU-US Data Privacy Framework
ElevenLabs	Optional text-to-speech: voices the in-app assistant’s replies, which can contain operational details such as vehicle registrations, and the voice on public pages	USA	EU-US Data Privacy Framework + Standard Contractual Clauses

Website-only services (no customer operational data)

These run on the public website only. They receive no customer operational data and are not sub-processors of it; any that set cookies load only with consent.

Provider	Purpose	Location	Transfer safeguard
LinkedIn Insight Tag	Marketing measurement on public pages — loads only after marketing-cookie consent, never inside the application or for signed-in users	EU / USA	Consent; LinkedIn DPA with Standard Contractual Clauses

2. Where customer data is stored

Customer data is stored in Microsoft Azure regions inside the EEA:

Norway East — the application and uploaded files (photos and documents).
Sweden Central — the database and the key vault that holds the application’s secrets.
Norway West — a geo-redundant copy of uploaded files.

Backups are also kept in the EEA. Some features send data to providers outside the EEA; they are listed in the table above with the safeguard for each transfer.

3. Transfers outside the EEA

Standard Contractual Clauses. Every transfer of personal data to a sub-processor outside the EEA is covered by the European Commission’s Standard Contractual Clauses (2021), as part of that provider’s data processing agreement.
EU-US Data Privacy Framework. Where a recipient is certified under the EU-US Data Privacy Framework, that certification is relied on as well. Where it is not, or its certification is under review, the Standard Contractual Clauses are the safeguard. The table above shows which applies to each provider.
Transfer impact assessments. Transfer impact assessments are being completed (target November 2026).

The binding terms are section 10 of the Data Processing Agreement.

4. How customers are told about changes

Before a new sub-processor starts processing customer data, we give at least 30 days’ notice, by e-mail to each customer’s administrators and by updating this page.

A customer may object on reasonable grounds during the notice period. If the objection cannot be resolved, the customer may terminate the affected service without penalty.

This is set out in section 6 of the Data Processing Agreement.

6. Questions

Questions about sub-processors or data transfers: dpo@yardtwin.com.