To run the Digital Workspace cloud service we use the service providers below. Each one is bound by a written contract with data protection terms at least as protective as our Data Processing Agreement, and transfers outside the European Economic Area rely on the safeguards described there.
1. Current subprocessors
| Provider | What it does | Personal data | Location | Used |
|---|---|---|---|---|
| Supabase, Inc. | Database and file storage | All workspace content and account data | European Union (Frankfurt, Germany) | Always |
| Vercel Inc. | Application hosting, content delivery, cookieless page-view statistics | Data passing through the application while in use; de-identified page-view data | European Union (Frankfurt, Germany) for application functions; global edge network for delivery | Always |
| Google LLC | Sending service emails (invitations, password resets, notifications) from our Google Workspace mailbox; Gmail connection | Recipient name and email address, email content; for connected Gmail accounts, the mailbox data described in the Privacy Policy | United States and other Google data centers | Service emails: always. Gmail connection: only when a user connects Gmail |
| Microsoft Corporation | Outlook connection | The mailbox data described in the Privacy Policy | Depends on the user's own Microsoft 365 tenant | Only when a user connects Outlook |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Subscription payments, invoices and tax calculation | Billing contact name and email, company name and address, VAT/tax ID, payment details (handled by Stripe; we never see full card numbers) | United States and European Union | Cloud subscriptions paid by card |
2. On-premise installations
On-premise installations run on the Customer’s own servers and send workspace content to none of the providers above. The only data an on-premise installation sends us is what is needed for licensing: the installation ID, license and app version, and usage counts such as the number of active users. No names, email addresses or business data are included. Email from an on-premise installation goes through the mail server the Customer configures.
3. Changes to this list
We will tell Customers by email at least 30 days before a new subprocessor starts processing their personal data, and update this page. A Customer may object on reasonable data protection grounds, as described in the Data Processing Agreement. To be added to change notices for your organization, email info@digitalworkspace.app.