Subprocessors / International Data Transfers
Version: 2026-10-15-review-3 · Effective date: October 15, 2026
Current and conditional services
The current services listed below support hosting, object storage, encrypted backups and email/mailbox. Maps and AI services process selected information when their features are used and are listed separately. Monitoring is disclosed separately because application user/request content is removed. Known regions and unverified locations are identified for each service. No payment provider currently processes Soteria platform-billing data.
Processing outside Egypt
Hosting, storage, email, maps, monitoring and AI services may process information outside Egypt. The list is operational disclosure, not a claim that all required contracts, licences or transfer permissions have been obtained. Contact [email protected] about locations, safeguards or proposed changes before sensitive processing.
Current provider registry
Current personal-data processors
Hetzner · Active
Application hosting and PostgreSQL
Information involved: Stored application data and operational traffic
Processing location: Actual server location requires confirmation
Provider referenceCloudflare · Active
R2 public/private object storage and DNS
Information involved: Media, private uploads, stored files and DNS traffic
Processing location: R2 placement not verified; no Egypt residency guarantee
Provider referenceBackblaze B2 · Active
Encrypted independent backups
Information involved: Encrypted database and object recovery copies
Processing location: Configured endpoint: eu-central-003; physical storage country and provider-side version retention not independently verified.
Provider referenceAmazon Web Services SES · Active
Transactional email delivery
Information involved: Recipient addresses and email content
Processing location: Configured SMTP region: eu-central-1 (Frankfurt region identifier); provider-wide secondary processing/contract terms not verified.
Provider referenceZoho Mail · Active
Support mailbox and synchronization
Information involved: Correspondence, sender details and attachments
Processing location: Documented .com tenant; exact processing location unverified
Provider referenceFeature-dependent processing
Google Maps Platform · Conditional on feature use
Maps, Places and geocoding when used
Information involved: Location queries, map interaction and network information
Processing location: Provider infrastructure; exact processing locations unverified
Provider referenceOpenAI · Conditional on feature use
Conditional AI-assisted import analysis when requested and configured; not every Person record is sent.
Information involved: Selected uploaded import data and prompts
Processing location: API processing location and contractual settings require confirmation
Provider referenceOther operational services
Better Stack · Operational service
Sanitized exception monitoring, uptime and job heartbeats
Information involved: Sanitized stack/release metadata, static route tags and availability signals. Application removes user/request payloads; provider handling of source IP/network metadata remains unverified.
Processing location: Processing region unverified
Provider referencePrivacy requests
Request access, correction, deletion where applicable, consent withdrawal, or raise a privacy concern. Include the relevant Organization and a safe reference; never send passwords or recovery codes. We may verify identity and coordinate with the responsible Organization.
[email protected]