Trust

Who else touches your data

Every organisation that processes customer data on our behalf, what they do with it, and which country it sits in. Last updated 2026-09-12.

There is one, and everything stays in the EU

Amazon Web Services is our only sub-processor. Every service we use runs in AWS European regions, so customer data does not leave the EEA and no Standard Contractual Clauses or transfer impact assessment are required. We use no analytics, advertising, session-recording, chat-widget or customer-data platform inside the apps, and the app pages make no requests to any third party at all.

The list

Sub-processor	What it does for us	Where
Amazon Web Services EMEA SARL Amazon DynamoDB	Stores bookings, meetings, invitations and reminders.	Ireland (eu-west-1)
AWS Lambda, Amazon API Gateway	Runs the application code that answers requests.	Ireland (eu-west-1)
Amazon S3, Amazon CloudFront	Serves the web pages themselves. No customer data is stored here.	Ireland, served from edge locations worldwide
Amazon Simple Email Service	Delivers sign-in codes, booking confirmations, calendar invitations and reminders.	Ireland (eu-west-1)
Amazon Chime SDK Meetings	Carries the audio and video of a meeting while it is happening. Nothing is recorded.	Media in Ireland (eu-west-1); the control API is in Germany (eu-central-1) because AWS publishes no such endpoint in Ireland. Both are in the EU.
AWS Secrets Manager, Amazon CloudWatch Logs	Holds service credentials, and the application logs. Logs record what happened, not what was said.	Ireland (eu-west-1)

AWS's own GDPR Data Processing Addendum is incorporated into the AWS Service Terms, so the processing chain from you, to us, to AWS is covered end to end without a separate signature.

What is deliberately not on this list

These are the usual entries on a page like this, and we want to be explicit that they are absent rather than leave you to infer it:

No analytics or product-telemetry service inside the apps.
No advertising or marketing-attribution network, anywhere.
No session recording, heatmap or screen-capture tool.
No support-chat widget embedded in a product page.
No transcription, summarisation or AI service receiving meeting audio.
No font, script or stylesheet loaded from another company's server — the app pages request nothing outside our own domains.

Changes

If we add a sub-processor, this page changes before the change takes effect, and customers with a signed Data Processing Agreement are told in advance so that they have the opportunity to object. To be told directly rather than checking this page, ask through the contact form.