Skip to main content
summa

Legal · Draft 1.0

Provider & Subprocessor Register

Core application data and AI inference are hosted in the Netherlands. Certain disclosed network-security, email and payment providers may process limited personal data internationally under appropriate transfer safeguards.

1. Register

The precise contracting entity and service configuration must match Summa’s signed provider agreements. This register forms part of the Privacy Notice.

ProviderFunctionData processedLocationTransfer position
Leafcloud (Netherlands)Kubernetes, compute, storage, networking and GPU infrastructureApplication, account, conversation, audit and operational dataNetherlandsIntended to remain in the Netherlands
Mailjet (Mailjet SAS, part of Sinch)Transactional and operational emailEmail address, name, email content, delivery metadataEuropean UnionProcessing within the EU; no transfer mechanism required
StripeCheckout, subscriptions, invoices, fraud and payment processingBilling details, payment identifiers, transaction and fraud dataEEA, United States and other documented locationsStripe contractual framework, adequacy mechanisms and/or SCCs

Stripe may act as an independent controller for some payment, fraud-prevention and legal-compliance activities rather than solely as Summa’s processor.

2. Our commitments

  • Maintain current provider DPAs and assess relevant transfers.
  • Notify business customers of intended new subprocessors and provide a reasonable objection period.
  • Remain responsible for subprocessors where required by law and contract.

Last updated: [insert date].