Subprocessors

1. How subprocessors are engaged

We engage subprocessors to host, secure, support and bill for the Service, and for the consent-gated analytics on the public site. Each is bound by a written contract with the data protection obligations Article 28(4) of the UK GDPR requires.

2. The current list

Categories of subprocessors we use for the Service. Each is bound by a written contract under Article 28(4) of the UK GDPR.

• Platform provider: Sylphx Limited, which provides Sylphx Cloud, the platform on which the Service runs;
• Infrastructure and hosting: Hetzner (Germany), hosting; Backblaze (Netherlands region), encrypted backups; Cloudflare (global edge network), TLS and proxy;
• Email delivery: providers that send account, security and notification email;
• Payments: Stripe, through Sylphx Money, which process subscription payments (card details go to the payment provider, not to us);
• AI inference processors bound by zero-retention terms, which process requests you make to AI features; and
• Analytics on the public site: a consent-gated analytics provider, used only if you consent.

3. Changes

We inform organisations of an intended addition or replacement before it takes effect, so that they can send any data protection objection in writing to legal@epiow.com under the processing terms at epiow.com/legal/dpa. If an objection is not resolved, the remedy is to stop using the affected part of the Service. We give organisations at least 14 days' notice of an intended addition or replacement where practicable, by updating this page or by email to the workspace owner.