Template — pending legal review. This text is a DSGVO baseline for the Xboard pilot. Replace bracketed placeholders and have a qualified German data-protection counsel sign off before public launch.
Sub-processors
Xboard uses the third-party processors below to deliver the service. Each is engaged under an Art. 28 GDPR data-processing agreement. Providers marked "only when the studio explicitly connects" receive data solely after a studio links that account; they receive no data otherwise. This list is referenced from our privacy policy.
Current sub-processors
| Processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Render Services, Inc. | Application hosting and PostgreSQL database | EU (Frankfurt) — migration in progress; currently US (Oregon) | EU/EEA hosting on completion of the EU migration; until then Art. 28 DPA + SCCs |
| Cloudflare, Inc. (R2) | Encrypted media and document storage (S3/R2-compatible) | EU | Art. 28 DPA + SCCs where applicable |
| Clerk, Inc. | Authentication and identity (operator sign-in, session issuance) | EU (residency configured) | Signed DPA + EU residency |
| Stripe Payments Europe, Ltd. | Payment processing and deposits (Stripe Connect) | Ireland (EU) | EU/EEA — Art. 28 DPA |
| Resend (Plus Five Five, Inc.) | Transactional and notification email delivery | USA | Art. 28 DPA + SCCs where applicable |
| Anthropic PBC | AI inference for the in-product assistant and drafting — only when configured as the active AI provider | USA | EU Standard Contractual Clauses |
| Amazon Web Services EMEA SARL (AWS Bedrock) | AI inference (Bedrock route) — only when configured as the active AI provider | EU (eu-central-1) | Art. 28 DPA + SCCs (activation gated on a signed AWS SCC) |
| Sentry | Application error and performance monitoring | EU | Art. 28 DPA + SCCs where applicable |
| Meta Platforms Ireland, Ltd. | Lead Ads ingestion, Conversions API, and Instagram/WhatsApp messaging — only when the studio explicitly connects a Meta account | Ireland (EU) | EU/EEA — Art. 28 DPA + SCCs for onward transfers |
| TikTok Technology Limited | Ads measurement and optimization — only when the studio explicitly connects a TikTok account | Ireland (EU) | Art. 28 DPA + SCCs where applicable |
| Google Ireland, Ltd. (Google / YouTube) | Ads measurement and YouTube publishing — only when the studio explicitly connects a Google/YouTube account | Ireland (EU) | Art. 28 DPA + SCCs where applicable |
Changes to this list
We may add or replace sub-processors. Material changes will be notified at least 30 days in advance via the dashboard, so studios can object before a new sub-processor begins processing.