Subprocessors / International Data Transfers

Providers and recipients

This supplement identifies the services used by Soteria and the information involved. Core hosting, files, recovery and email services are distinguished from feature-dependent Maps, AI, Paymob and browser/device push, and operational monitoring. Not every record is sent to every provider. Selected optional content, technical network traffic and provider account/administrative data can have different flows. Paymob can receive checkout contact/order information even in restricted test mode; the earlier assertion that no payment provider processes platform-billing data no longer describes the integration. Browser push also uses a device-selected delivery service. Neither listing a recipient nor enabling a feature supplies consent, merchant approval or a transfer permit.

Processing roles

A subprocessor processes relevant Organization data on Soteria's behalf under applicable written duties. Some recipients also determine their own payment, fraud, network, account-security or legal purposes and may be independent controllers for that processing. The actual operation and applicable terms determine the role, not merely inclusion under this page's title. The descriptions below identify those distinctions without asserting that all contracts or legal entities have been verified. The Organization DPA governs Soteria's obligations for directed processing. Your Organization's own recipients, public sharing and exports are separate instructions; public links and recipient/device copies can extend beyond server access controls.

What is known about locations

Non-secret live metadata checked on 29 October 2026 identified the app/database server as Hetzner hel1-dc2 in Helsinki, Finland, SMTP delivery as AWS eu-central-1 in Frankfurt, Germany, and the backup endpoint as Backblaze eu-central-003. Backblaze documents EU-Central file storage in Amsterdam, Netherlands; that mapping is a provider-supported inference. The configured Zoho .com endpoints correspond to its US data-center domain under provider guidance, without independently confirming every tenant/support location. R2 bucket jurisdiction/placement, relevant AI and monitoring project settings, payment and browser-push processing countries and additional provider/support/onward destinations are not all verified. Provider marketing, an endpoint region, encryption or a European application server does not prove exclusive residency for every data category. Configuration is not a complete inspection of actual traffic or every stored copy.

Provider terms and evidence

Published privacy policies, processing terms and technical guidance are linked as references, not proof that Soteria has verified every applicable agreement, account, version, legal entity or required schedule. Some providers incorporate processing terms into service terms automatically; others offer an account-specific DPA process. A separate handwritten signature is not universally required, but applicable and retained evidence is still necessary. We must verify the appropriate contractual duties, recipients and countries and required safeguards for the actual processing, including onward providers. Public EU standard clauses, provider certifications or a general Organization acceptance are not themselves an Egyptian transfer authorization. No particular signed agreement, completed audit, registration, licence or transfer permission is asserted where it has not been verified.

Transfers outside Egypt

The service can involve processing outside Egypt, including the confirmed/inferred locations and unverified destinations described here. Egyptian requirements for international processing and sensitive/child data must be assessed for the actual purpose and recipient, including required regulatory permissions and destination protection. Other applicable laws may impose additional safeguards. The Privacy Notice, this list, general contract acceptance, browser permission, encryption or guardian consent alone does not complete those requirements. A feature must not be used for processing lacking the required authority merely because the software allows it. Contact [email protected] about the relevant destination, role and safeguards before introducing sensitive processing.

Changes and Organization objections

The reviewed version freezes this provider information; earlier frozen lists remain accessible with their original document versions. Later facts are not silently inserted into an older snapshot. An earliest version that did not store a provider list is identified as such and links to the current supplement. For proposed subprocessor additions/replacements, Soteria must follow the applicable Organization DPA's direct notice, meaningful objection and resolution requirements. Merely editing this public list is not direct notice. An unresolved objection or missing legal permission cannot be treated as consent to move the affected Organization's data. Independent-recipient or purpose changes also require the appropriate assessment and notice/authority.

Questions and privacy requests

Contact Daniel Ashraf Ekdawi at [email protected] for provider, location, safeguard or privacy questions. Identify the relevant Organization/function with safe references; do not send passwords, recovery codes or unnecessary sensitive records. A Person does not need an Account or new contractual acceptance to raise a privacy request. This is a service-provider disclosure, not a claim that every outstanding compliance task has been completed. The Privacy Notice explains rights and retention; the Organization DPA explains instructed processing and operational obligations. Historical content remains evidence of what that version said, not a guarantee that a past configuration is still current.

Provider list