Sub-processor
Country
Service type
Data concerned
Safeguards
Infomaniak Network SA
Core
🇨🇭 Switzerland
Cloud hosting, databases, backups
HR data, customer documents, configuration files
100% Swiss hosting, GDPR & FADP, ISO 27001
Microsoft Ireland Operations Ltd.
Core
🇪🇺 EU
Sending platform emails (Microsoft 365, Exchange Online); optionally: single sign-on and directory sync (Entra ID), document storage (OneDrive), collaboration tools
Recipients’ first name, last name and email address, email and notification content; optionally: identifiers, access metadata, directory attributes (job title, department, manager), internal documents
EU hosting, GDPR, ISO 27001
Vercel Inc.
Core
🇺🇸 USA
Hosting and delivery of the application’s web interface (static files, content delivery network)
IP address and technical connection data (logs); no HR data, which remains hosted at Infomaniak
SCCs, EU-US and CH-US frameworks (DPF certified)
Atlassian Pty Ltd.
Core
🇪🇺 / 🇺🇸
Tickets and project documentation (Jira, Confluence)
Contact data, support ticket content
Standard Contractual Clauses, GDPR
Google Ireland Ltd.
Core
🇪🇺 EU
Internal collaboration tools (Google Workspace)
Internal Illizeo data only
GDPR, ISO 27001
Google Fonts (Google Ireland Ltd.)
Core
🇪🇺 / 🇺🇸
Delivery of the fonts used by the application’s web interface
IP address and technical browser data
SCCs, EU-US and CH-US frameworks, no cookies
Google Sign-In (Google Ireland Ltd.)
Optional — Sign-in
🇪🇺 / 🇺🇸
Authentication via Google account (social sign-in or the customer’s Google Workspace SSO)
Google identifier, first name, last name, email address
SCCs, EU-US and CH-US frameworks
Google Maps Platform (Google Ireland Ltd.)
Optional — Addresses & mileage
🇪🇺 / 🇺🇸
Address autocomplete and geocoding (Places, Geocoding) for profiles and mileage expense claims
Addresses entered, trip start and end points, geographic coordinates
SCCs, EU-US and CH-US frameworks, API key restrictions
DocuSign Inc.
Optional — Signature
🇪🇺 / 🇺🇸
Electronic signature of contracts
Last name, first name, email, signature, signed-document metadata
SCCs, GDPR, ISO 27001
Adobe Inc. (Adobe Sign)
Optional — Signature
🇪🇺 / 🇺🇸
Alternative electronic signature
Last name, first name, email, electronic signature
SCCs, GDPR
UgoSign
Optional — Signature
🇫🇷 FR
Alternative electronic signatures (eIDAS compliant)
First name, last name, email, electronic signature
GDPR, processing and hosting in France
Okta Inc. (Okta, Auth0)
Optional — SSO
🇪🇺 / 🇺🇸
Authentication and identity management (SSO)
Identifiers, login metadata
SCCs, GDPR
Veryfi, Inc.
Optional — Expense claims
🇺🇸 USA
OCR and automatic data extraction from expense receipts and supporting documents
Receipt and supporting-document images, extracted data (merchant, amounts, dates, VAT), user identifier
SCCs, administrative, technical and physical safeguards
Slack Technologies Ltd. (Salesforce)
Optional — Notifications
🇪🇺 / 🇺🇸
Notifications and approval requests in the customer’s Slack workspace
First name, last name, work email address, notification content (absences, expense claims, approvals)
SCCs, EU-US and CH-US frameworks, app installed by the customer in their own workspace
Zoom Communications, Inc.
Optional — Video meetings
🇪🇺 / 🇺🇸
Creation and management of interview video meetings (recruitment, reviews)
Participants’ first name, last name and email address, meeting subject and times
SCCs, EU-US and CH-US frameworks
360Learning SAS
Optional — Training
🇫🇷 FR
Automatic creation and update of learner accounts (SCIM) in the customer’s 360Learning platform
Employee number, first name, last name, work email address, job title, department, site, manager’s employee number, active or inactive status
GDPR, app enabled by the customer in their own 360Learning workspace
Browser push notification services (Google, Mozilla, Apple, Microsoft)
Optional — Push notifications
🇪🇺 / 🇺🇸
Delivery of push notifications to the browser of the user who enabled them
Browser subscription identifier; notification content end-to-end encrypted and unreadable by the service
End-to-end encryption (RFC 8291), enabled by the user in their browser
