Sub-processors
Last changed: 22 August 2026 · This page is the authoritative list referenced by clause 7 of our DPA.
Four companies, all in the EU. This is the page your procurement team is looking for, and it is public so nobody has to ask for it.
| Sub-processor | Purpose | Location | Data it can see |
|---|---|---|---|
| Hostinger International Ltd (Cyprus) | Web hosting and the MySQL database that stores your compliance file | France (EU) | Everything you enter: account email, AI register, policy, employee training records, evidence log, server logs. |
| Stripe Payments Europe, Ltd (Ireland) | Payments, invoicing and the customer billing portal | Ireland (EU), with group transfers under Standard Contractual Clauses | Billing email, name, company, VAT number, payment details and invoice history. Card numbers never reach our servers. |
| Brevo SAS (France) | Transactional and product email — sign-in links, receipts, readiness reports | France (EU) | Recipient email address, message content, delivery and bounce events. |
| Plausible Insights OÜ (Estonia) | Audience measurement on the public site | Germany (EU) | Aggregated page views only. No cookies, no cross-site identifier, no personal data — visitor data is never used to identify anyone. |
How we change this list
We give at least 30 days' notice before adding or replacing a sub-processor: an email to your account address, and an update to this page with a new date at the top. Within those 30 days you may object on reasonable data protection grounds by writing to hello@actcovered.com; if we cannot resolve the objection, you may terminate the affected service and we refund the unused part of anything paid in advance. The full procedure is clause 7 of the DPA.
To be notified of changes even if you are not a customer, email hello@actcovered.com with “subprocessor updates” in the subject.
What we removed
Until this platform change, application data and authentication ran on Supabase (AWS, Ireland). That dependency has been removed: the database now runs on our host's servers in France, and the data Supabase held has been migrated and deleted at source. We mention it because a sub-processor list that only ever grows is not a list anyone should trust.
What we do not use
- No advertising or marketing trackers. No Google Analytics, no Meta pixel, no LinkedIn tag, no session replay. Audience measurement is Plausible, which sets no cookies and collects no personal data.
- No AI sub-processor. Your compliance file is not sent to any model provider, and it is not used to train anything. The risk classification in the product is deterministic logic, not an LLM call.
- No CRM holding your file. Sales and support email lives in the same Brevo mailbox that sends your sign-in links; nothing exports your register or your training log into a third-party system.
- No data brokers, ever. We do not sell, rent or enrich customer data.