---
title: Sub-processors | Pro Digital Key
description: Complete list of sub-processors that process personal data on behalf of Pro Digital Key, with location and legal basis for transfer.
canonical: https://prodigitalkey.com/en/sub-processors/
lang: en
alternates:
  en: https://prodigitalkey.com/en/sub-processors/
  pt: https://prodigitalkey.com/pt/sub-processadores/
---

[Home](/en/) › Sub-processors

# Sub-processors

Last updated: 12 May 2026

## Legal framework

Pro Digital Key relies on third parties (sub-processors) to deliver its services. Each sub-processor processes personal data on our behalf and under our instructions, pursuant to data processing agreements (DPAs) entered into under **Article 28 of the GDPR**.

Where processing involves transfer outside the European Economic Area (EEA), we apply one of the safeguards in **Chapter V of the GDPR (Articles 44 to 49)**: a European Commission adequacy decision, Standard Contractual Clauses (SCCs — Decision 2021/914), or the _EU-US Data Privacy Framework_ (DPF).

## Current list of sub-processors

-   ✓ **Anthropic, PBC** — Content analysis and generation via the Claude API. Location: _United States_. Transfer basis: SCCs + EU-US DPF.
-   ✓ **Twilio Inc.** — Transactional SMS delivery. Location: _United States_. Transfer basis: SCCs + DPA + EU-US DPF.
-   ✓ **Amazon Web Services EMEA SARL (SES)** — Transactional email delivery. Location: _Ireland (EU/EEA)_. Transfer basis: not applicable.
-   ✓ **Emailit LTD** — Email _fallback_ delivery. Location: _United Kingdom_. Transfer basis: EU–UK adequacy decision (2021).
-   ✓ **Google Ireland Limited (Google Workspace)** — Business mailbox and commercial communications. Location: _Ireland (EU/EEA)_, with processing by group entities in the US. Transfer basis: SCCs + EU-US DPF.
-   ✓ **Contabo GmbH** — Application server hosting (VPS). Location: _Germany (EU/EEA)_. Transfer basis: not applicable.
-   ✓ **pCloud AG** — Encrypted off-site backups. Location: _Switzerland_. Transfer basis: Adequacy Decision 2000/518/EC.
-   ✓ **Google Ireland Limited (Google Drive)** — Encrypted off-site backups. Location: _Ireland (EU/EEA)_, with processing in the US. Transfer basis: SCCs + EU-US DPF.
-   ✓ **Amazon Web Services EMEA SARL (S3)** — Encrypted off-site backups. Location: _Ireland (EU/EEA)_. Transfer basis: not applicable.

## Local components (not sub-processors)

The following components do not qualify as external sub-processors because they do not involve the transfer of personal data to third parties:

-   ✓ **MaxMind GeoLite2** — database downloaded and queried locally on our servers; no data is sent back to MaxMind.
-   ✓ **GlitchTip** — error-monitoring system hosted on our own infrastructure.

## Your rights

Under **Article 13(1)(f) of the GDPR**, you have the right to be informed of these international transfers and, upon request, to obtain a copy of the safeguards in place. You may also object to processing by a specific sub-processor (Article 21) by contacting [dpo@prodigitalkey.com](mailto:dpo@prodigitalkey.com).

## Changes

This list is updated as our infrastructure evolves. We undertake to notify material changes by email to data subjects with an active relationship with us, with at least **14 days' notice**, allowing the right of objection to be exercised before the change takes effect.

Questions about any of these sub-processors?

[Privacy Policy](/en/privacy-policy/)