1. How to read this list
When MessageMind processes personal data on a customer's behalf we act as processor under Article 28 GDPR. The companies below are our sub-processors: they may process that data to deliver part of the service.
Not every sub-processor applies to every customer. The hosting, backup and storage providers serve every account; the other vendors are only engaged where the customer enables the corresponding channel, integration or feature. Systems the customer connects themselves (their own CRM, shop, PMS or booking platform) are the customer's own controllers or processors, not ours.
2. Current sub-processors
| Sub-processor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Hetzner Online GmbH | Servers and primary application database | All platform records, including conversation content | EU (DE) |
| Backblaze, Inc. | Encrypted database backups | Encrypted copies of all platform records | EU (NL) |
| Cloudflare Inc. | Object storage (R2) for media, attachments and exports; CDN, DNS and DDoS protection | Files, images, recordings and generated exports; IP address, request metadata | EU |
| Meta Platforms Ireland Ltd | WhatsApp Business and Instagram messaging channels | Message content, profile identifiers, phone numbers | EU |
| OpenAI, L.L.C. | Text generation for AI agent replies | Conversation content submitted for generation | EU |
| ElevenLabs Inc. | Speech synthesis and voice agent audio | Text prompts and generated or supplied audio | EU |
| Twilio Inc. | SMS and voice telephony | Phone numbers, message content, call metadata | EU |
| Pinecone Systems Inc. | Vector index for knowledge retrieval | Embeddings derived from customer knowledge content | EU |
| Cloudinary Ltd | Image and media transformation and delivery | Images and media supplied by the customer | EU |
| Stripe Payments Europe Ltd | Subscription billing and customer deposits | Billing contact, payment metadata (no full card data) | EU |
| Google Ireland Ltd | Calendar, mailbox, Business Profile and website analytics | Calendar events, mailbox content where connected, usage events | EU |
| Microsoft Ireland Operations Ltd | Outlook / Microsoft 365 mailbox and calendar integration | Mailbox and calendar content where connected | EU |
Every sub-processor on this list processes personal data in the EU, including the providers that host the platform, its database and its backups. For a vendor security review, write to [email protected].
3. Contractual safeguards and transfers
Each sub-processor is bound by a written agreement imposing data-protection obligations no less protective than those in our own DPA, including confidentiality, security measures and assistance duties.
If a sub-processor ever needs to transfer personal data outside the EU/EEA, for example for technical support, we rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures where required. Details are available on request.
4. Changes and right to object
We keep this page current. Customers who have asked to be notified receive at least 30 days' notice before a new sub-processor starts processing their data, or as soon as practicable where a change is urgent for security or continuity.
A customer may object to a new sub-processor on reasonable data-protection grounds within that notice period. If we cannot offer a workable alternative, the customer may terminate the affected part of the service. To subscribe to notifications, write to [email protected].
