Legal / 04
Sub-processors
Last updated 29 September 2026
This register distinguishes active hosting from integrations prepared for launch. Google Cloud and Neon host the scan pilot in Frankfurt. Ancillary providers can operate globally; primary EU storage does not mean every identity, billing or edge operation stays in the EU.
| Provider | Location | Purpose |
|---|---|---|
| Google Cloud | Frankfurt, Germany | Cloud Run, Cloud Tasks, storage and secrets |
| Neon | Frankfurt, Germany | Managed PostgreSQL |
| Paddle | As described in Paddle’s privacy notice | Planned billing integration; not active in the scan pilot |
| Brevo | As described in Brevo’s DPA | SMTP configured; product email not open in the pilot |
| Cloudflare | Global edge network | Prepared for custom domains; activation depends on DNS delegation |
| Sentry | Not configured | Planned error monitoring; no pilot data sent |
| Google Analytics | As described in Google’s privacy policy | Visitor analytics on thaviq.com only, after cookie consent |
Identity and payment providers
Optional Google sign-in sends identity requests to Google and returns basic profile information to THAVIQ. Google acts under its own privacy policy. Paddle acts as Merchant of Record for its sales under its own privacy notice; it is not simply a hosting sub-processor.
Changes
Customers may subscribe to changes by emailing privacy@thaviq.com. Material additions are announced before the new provider starts processing customer data where the applicable DPA requires notice.