Current subprocessors Art. 28(2)
| Subprocessor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Microsoft Ireland Operations Limited (Microsoft Azure) | Hosting, database, storage and backups of Qimbas™ | Sweden Central (EU) | Customer data is stored within the EU. For Microsoft’s limited access from outside the EU/EEA for support and security operations: the European Commission’s standard contractual clauses (2021) in Microsoft’s data processing agreement |
| Cloudflare, Inc. (USA) | DNS, TLS, firewall and the tunnel to the service | Cloudflare’s global network. Traffic is decrypted in the data centre that receives it, which can be outside the EU/EEA | EU–US Data Privacy Framework, with the European Commission’s standard contractual clauses in Cloudflare’s data processing agreement as fallback |
| Anthropic Ireland, Limited, with Anthropic, PBC (USA) | AI model for the analysis (default) | Processing in the USA, Europe, Asia or Australia; storage in the USA | The European Commission’s standard contractual clauses in Anthropic’s data processing agreement |
| Amazon Web Services EMEA SARL (Luxembourg), Amazon Bedrock | AI model for customers who have chosen processing within the EU | Stockholm (eu-north-1), or Ireland (eu-west-1) if agreed with the customer |
Not applicable: the data stays in the chosen EU region |
| Google Cloud EMEA Limited (Ireland), Vertex AI | AI model for customers who have chosen processing within the EU | Google’s EU multi-region (eu) |
Not applicable: processing takes place in the EU multi-region. Google’s data processing addendum includes the European Commission’s standard contractual clauses for any transfer |
Customers who have chosen processing within the EU get the AI model from Amazon Bedrock or Google Vertex AI, as agreed. Each customer uses one of them.
How changes are announced
Customers who want notice of intended changes to subprocessors can email hey@creedcon.se with the subject ‘Subprocessors’. We announce changes at least 30 days before a new subprocessor starts processing personal data, so that the customer can object under the data processing agreement.
History
| Date | Change |
|---|---|
| 22 September 2026 | Page published. |
| 9 October 2026 | Subprocessors named. The email provider was removed, as the service does not send email. |
| 16 October 2026 | Wording changes. The list is unchanged. |
| 18 October 2026 | Google Cloud EMEA Limited (Vertex AI) added, as a second option for customers who have chosen to have the AI model run within the EU. |