Kortyx Cloud Subprocessors

This list identifies providers appointed to process personal data in Customer Content for hosted Kortyx Cloud. The Data Processing Agreement governs instructions, appointment, responsibility, international transfers and changes. The list presented with the accepted agreement identifies the initially authorized providers. A later revision does not retrospectively change the version presented to a customer.

Provider roles depend on the actual processing. Account administration, optional product analytics and ordinary correspondence also have recipients described in the privacy notices; they are not automatically the same processing as hosting customer application content. A provider may act in more than one role for different activities.

Applicable account agreements determine the processing entity and safeguards. We will not rely on a provider’s general marketing statement as a substitute for the relevant processing agreement. Information about applicable transfer safeguards may be requested at legal@kortyx.io, with only necessary redaction of confidential or security-sensitive details.

Resend (Plus Five Five, Inc.) delivers transactional account/security and service email. PostHog, Inc. receives the bounded product-use measurements described in the privacy notices. Google Workspace handles private legal/security correspondence. They do not receive the customer trace store merely because they provide those functions. Their actual roles and data are disclosed in the Cloud Privacy Notice and Website Privacy Notice.

Customers should not attach unnecessary application content to ordinary email or post it in public support. If a support or export workflow would appoint an additional provider to process Customer Personal Data, we will assess and authorize that flow under the DPA before using it. A controller-purpose label must not be used to conceal a provider’s actual access to customer content.

Application endpoints and model services independently selected and engaged by a customer follow the customer’s own arrangements and instructions. They are not automatically Kortyx-appointed subprocessors. If Kortyx supplies such a service as its own offering, its role will be assessed and this list updated before relying on the customer-selected distinction.

Keycloak and c15t are self-hosted components in the service. Their software vendors are not separate recipients solely because the software is used. Any vendor support access or telemetry that changes that position requires its own assessment. Authorized internal personnel are governed by access and confidentiality controls; an external contractor with content access must be assessed on its actual role.

Before a subprocessor receives Customer Personal Data, Kortyx assesses the relevant role, data, security, deletion, incident assistance, locations and onward processing, and establishes the required written obligations. Kortyx remains responsible for its appointed subprocessor’s performance of those obligations as required by the DPA and applicable law.

Core EU hosting and encrypted backups are specific safeguards. They are not certification of the whole service, a promise that no provider can receive metadata outside the EU, or a substitute for a valid international-transfer arrangement. Confidential account records can support customer due diligence without publishing credentials, private network configuration or unrelated customer information.

For an ordinary addition or replacement, Kortyx will give designated customer contacts at least 30 calendar days’ advance notice before the proposed provider begins the affected processing. The notice identifies the provider, function, affected data, relevant locations and safeguards, proposed start date and objection contact. We will notify affected customers directly; merely editing this web page is not the entire notice procedure.

This is a necessary service notice, independent of marketing subscriptions and whether a customer signs in. An urgent situation is handled under DPA section 7.6, including specific authorization where necessary; urgency is not a general exception for routine provider changes.

Send a reasonable data-protection objection to legal@kortyx.io during the notice period, identifying the affected organization, provider and concern. Kortyx will respond before the proposed processing starts and work toward a reasonable resolution, such as additional safeguards, a supported alternative or excluding the affected function.

If the objection cannot be resolved, the customer may terminate the affected service without a termination penalty, subject to the agreed retrieval, switching and deletion process. Kortyx will not send that customer’s affected data to the new provider while the objection is unresolved unless another lawful, agreed basis permits it. Neither party is required to accept an unlawful arrangement.

Each published list has a date, version and permanent link. Historical versions explain earlier appointments; they do not authorize an unnotified current provider. Publication, contractual acceptance and optional consent are separate processes. Questions about provider scope or safeguards may be sent privately to legal@kortyx.io without purchasing a paid support plan.