This page lists every sub-processor that Capptions B.V. engages to deliver the Capptions services. It satisfies Article 28(2) GDPR and the notification obligation in Section 6 of our Data Processing Agreement.
- Version: 2026.3
- Last updated: 14 September 2026
- Notification of changes: at least 30 days in advance, by email and in-app.
To subscribe to change notifications, email privacy@capptions.com.
Infrastructure & platform
| Sub-processor | Role | Location of processing | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS) | Object storage for uploaded media and documents (S3), transactional email (SES), notifications (SNS), CDN (CloudFront, serving cdn.capptions.com and download.capptions.com), and the container image registry (ECR). Not primary application hosting. | EU — Ireland (eu-west-1) | EU — none required for the storage path; SCCs + EU–US DPF for any AWS corporate access |
| Hetzner Online GmbH | Primary application hosting — Kubernetes (k3s) cluster of 6 nodes, primary application databases (MongoDB replica set, Redis, OpenSearch) and object storage for Kubernetes persistent volumes | Germany (primarily Nuremberg) | EU — none required |
| Better Stack Inc. | Log management, uptime monitoring, incident management / on-call, and error tracking. Receives application and infrastructure logs shipped from the whole Kubernetes cluster, plus application error reports. | EU — error tracking ingests in Frankfurt, Germany (eu-central-1a); data region configured as “germany” | [VERIFY with privacy owner — transfer mechanism not yet determined] |
| Cloudflare, Inc. | DNS, CDN, DDoS protection, WAF | EU edge locations preferred; global anycast | SCCs + EU–US DPF |
AI sub-processors
Engaged only when AI features are enabled by the Controller. Customer Data is never used to train models; zero or short-retention modes are configured where available. See the AI Policy for details.
The AI provider mix is in active review as Capptions AI and Seveso.app AI features move from beta to production defaults. The authoritative, dated list of AI sub-processors, models and regions is maintained on this page and customers receive a 30-day notice by email and in-app before any change to the production default.
The current criteria for any listed AI sub-processor are: EU-region inference, contractual no-training on Customer Data, zero retention beyond the response (or ≤ 24 h abuse window), Art. 28 GDPR terms, and enterprise support. Ask ai@capptions.com for the current list under NDA if it is required for a procurement or DPIA review before the next public update.
Business operations
| Sub-processor | Role | Location of processing | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd | Payment processing for the Direct Marketplace and subscriptions | Ireland; some processing in the US | SCCs + EU–US DPF |
| HubSpot Ireland Ltd | CRM, marketing automation, email | Ireland; some processing in the US | SCCs + EU–US DPF |
| Google Workspace (Google Ireland Ltd) | Internal email, calendars, documents — incidental Customer Data only in support tickets | Ireland; some processing in the US | SCCs + EU–US DPF |
| Sentry (Functional Software Inc.) | Error monitoring (scrubbed of PII at SDK level) for the Go-based media and audit services, and the legacy white-label mobile apps and legacy web client only. The main API, the web router and the Capptions Direct mobile app report errors to Better Stack instead. | EU region | SCCs + EU–US DPF |
| Linear Orbit Inc. | Engineering issue tracking — incidental Customer Data only in support tickets | US | SCCs + EU–US DPF |
Notes
- Capptions B.V. is itself the controller for account, billing and marketing data, and the processor for Customer Data uploaded by users.
- All sub-processors are bound by Art. 28 GDPR terms providing at least the same level of protection as our DPA, including audit support, breach notification and assistance with data subject requests.
- Transfer Impact Assessments are on file for each non-EEA sub-processor.