Sub-processor list
This page lists every third party that processes personal data on behalf of Aegis Firma. We notify all customers 30 days before adding a new sub-processor, in accordance with GDPR Article 28(2).
Last updated: 2026-05-22 · 4 sub-processors
30-day advance notice: We will notify you by email at least 30 days before adding or replacing any sub-processor. You have the right to object. Email privacy@aegisfirma.com to object to a specific sub-processor.
Supabase
Database, authentication, and file storageLocation
EU (Germany — Frankfurt)
Transfer basis
No transfer — EU region only
Data shared
All customer and org data including account info, compliance records, documents, evidence, audit logs
Cloudflare
CDN, DDoS mitigation, DNS, and WAFLocation
United States (with EU nodes)
Transfer basis
Cloudflare EU DPA + SCCs (GDPR Art. 46(2)(c))
Data shared
IP addresses (ephemeral), HTTP request metadata, response headers
Resend
Transactional email deliveryLocation
United States
Transfer basis
Standard Contractual Clauses (EU SCCs 2021)
Data shared
Recipient email address, email content (alerts, reports, invitations)
LemonSqueezy
Payment processing and subscription managementLocation
United States / EU
Transfer basis
Standard Contractual Clauses (EU SCCs 2021) + Merchant of Record
Data shared
Name, email address, billing address, payment method (card details processed by LemonSqueezy — never touch our servers)