Sub-processors
This is a translation for convenience. The binding version of this document is the Spanish one: Subencargados del tratamiento. In case of discrepancy, the Spanish text prevails.
<p>
Third parties that may process personal data on MicroLab's behalf. Article 28(2) GDPR
requires notice of additions and changes: they are announced <strong>30 days</strong> in
advance and the Customer may object.
</p>
<div class="legal-table-wrap">
<table>
<thead>
<tr>
<th>Sub-processor</th><th>What for</th><th>Data</th><th>Location</th><th>Safeguard</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Cloudflare, Inc.</strong><br />USA</td>
<td>Team catalogue storage, usage records, quota counter and running the service</td>
<td><strong>End-to-end encrypted</strong> scenarios; metadata in the clear; usage records</td>
<td><strong>EU</strong>: storage under European jurisdiction and database in Western Europe</td>
<td>Standard Contractual Clauses + EU-US Data Privacy Framework</td>
</tr>
<tr>
<td><strong>Functional Software, Inc.</strong> (Sentry)<br />USA</td>
<td>Error diagnostics</td>
<td>Exception traces, version, operating system, installation identifier, IP</td>
<td><strong>EU</strong> (Germany)</td>
<td>Standard Contractual Clauses + Data Privacy Framework</td>
</tr>
<tr>
<td><strong>Kinde Inc.</strong><br />Australia / USA</td>
<td>Authentication and identity</td>
<td>Email, name, account identifier, organisation</td>
<td>See their documentation</td>
<td>Standard Contractual Clauses</td>
</tr>
</tbody>
</table>
</div>
<h2>What is NOT a sub-processor</h2>
<p>
<strong>The copilot's AI provider.</strong> The user picks their own (Anthropic, OpenAI,
Google, a local model…) and uses <strong>their own key</strong>: the conversation goes
from their machine to the provider <strong>without passing through MicroLab</strong>. We
neither broker nor store it, so it is not a sub-processor of ours but processing of the
user's own, governed by whatever contract they have with that provider.
</p>
<p>
This is stated explicitly because it is the question every security department asks on
seeing the word “copilot”, and the right answer changes who is accountable for what.
</p>
<h2>Change history</h2>
<div class="legal-table-wrap">
<table>
<thead><tr><th>Date</th><th>Change</th></tr></thead>
<tbody>
<tr>
<td>2026-07-28</td>
<td>Initial document. Cloudflare added as sub-processor for the team catalogue (Team plan, hosted option).</td>
</tr>
</tbody>
</table>
</div>