1. Infrastructure
| Company | What it does | Where the data is |
|---|---|---|
| Amazon Web Services EMEA SARL | Servers for the app, the API and the database | Zurich, Switzerland (Frankfurt, Germany, for any service not available in Zurich) |
| Infomaniak Network SA | Server for the website (wiiseto.com) | Geneva, Switzerland |
| Cloudflare, Inc. | Network in front of all our sites: encryption (TLS), protection against attacks, caching | Global network; the nearest point to each visitor. US company |
| Cloudflare, Inc. (R2) | Storage of files, profile pictures, share images and database backups | European Union (EU jurisdiction bucket) |
| Hyperping SAS | Public status page and uptime checks. The app asks it whether Wiiseto is up, so it sees your IP address; no cookies are sent. Our background jobs report to it that they ran, with no personal data | Frankfurt, Germany (Hyperping is a French company) |
Cloudflare decrypts traffic at its edge to protect it, then encrypts it again towards our servers. That means it technically sees what passes through, like any network provider of this kind. It is bound by its data processing terms and the EU-US Data Privacy Framework.
2. Service operations
| Company | What it does | Where the data is |
|---|---|---|
| Amazon Web Services EMEA SARL (Amazon SES) | Sends our emails: recipient address, subject and content | Zurich, Switzerland, or Frankfurt, Germany; delivery to the recipient's provider wherever it is |
| Stripe Payments Europe Ltd / Stripe, Inc. | Payments, invoices, subscriptions: company name, billing email, address, tax number, card | EU and United States |
| PostHog, Inc. | Product analytics, only for people who say yes | EU cloud, Frankfurt |
MaxMind's location database runs on our own servers. Nothing is sent to MaxMind, so it is not a sub-processor.
3. AI providers
AI is on by default for a new company and can be switched off in Company > AI & Credits. When it is off, nothing is sent to any of these providers.
| Company | What it does | Where | Trains on your data? |
|---|---|---|---|
| OpenAI, L.L.C. | Assistant, summaries, writing help | United States | No (API terms) |
| Anthropic, PBC | Assistant | United States | No (API terms) |
| Mistral AI SAS | Text recognition (OCR) | France | No (API terms) |
OpenAI and Anthropic process requests in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. Switch AI off if this is not acceptable for your company.
4. Services you connect yourself
These are not our sub-processors: you choose to connect them, and your relationship with them is under their own terms.
| Service | When | What happens |
|---|---|---|
| Google (Sign-In, Calendar) | If you sign in with Google or connect Google Calendar | We receive your profile, or read your calendar events (read-only) |
| Microsoft (Sign-In, Outlook) | If you sign in with Microsoft or connect Outlook | Same as above |
| Your company's identity provider (SSO) | If your company sets up single sign-on | We receive the identity it confirms |
| Your browser's push service (Google, Mozilla, Apple, Microsoft) | If you allow notifications | It carries notifications, whose content is encrypted end to end |
Disconnecting a calendar in Wiiseto stops the import but does not yet revoke our access at Google or Microsoft. Remove Wiiseto in your Google or Microsoft account settings too.
5. Changes to this list
We email your company's founder at least 30 days before adding or replacing a sub-processor, and publish the change here with its effective date. You can object within those 30 days, as described in section 7 of the DPA. Removing a sub-processor needs no notice.