> ## Documentation index
> Fetch the complete documentation index at: https://docs.odysseysignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Processing Agreement - Sub-processors

> List of data sub-processors for all Odyssey services

Version 1 · Effective 29 April 2026

When sub-processors are added or removed by Odyssey, the table below is updated.

For further details about sub-processors, see the appendix “Specification of the Processing of Personal Data” in your agreement, as well as the links below for further information regarding each sub-processors management of data privacy.

According the regulations around GDPR, we are only obligated to disclose the sub-processors we use to store personal information. However we want to be fully transparent with all our sub-processors, so all our sub-processors are listed below, even if they are not processing any personal information according to GDPR regulations.

## 1. Public Websites, Products & Services (logged in services)

Sub-processors used by our public websites and logged in products and services.

Information stored about users within our logged in services are name, e-mail address and company association. No other personal information is stored.  
If the user also is a business agreement contact of Odyssey we may store phone numbers, addresses and other contact information for the business account to maintain the business relation and communication.

### 1.1 Sub-processors processing personal information

| Name | Location of processing* | Purpose | Transfer Mechanism |
| --- | --- | --- | --- |
| Auth0 | EU | Authentication & Security Services | EU–US DPF + SCCs (Okta Inc.) |
| Google Cloud Services | EU (Finland, Germany) | Main infrastructure provider | EU–US DPF + SCCs (Google LLC) |
| Hubspot ** | EU | CRM, Support, Communication and Statistics. | EU–US DPF + SCCs (HubSpot Inc.) |
| Cloudflare *** | Global | Security, firewall, crypto, TLS, SSL infrastructure. | SCCs (Cloudflare Inc.) — see note *** |
| Google Analytics (GA4) **** | EU | Statistics | — |

**\* Processing** = Every operation performed with respect to personal data, e.g. storage, collection, recording, organisation, adaptation, alteration or disclosure by transmission.

\*\* **Hubspot** is used for usage statistics by our logged in services, and stores user information and usage behaviour for support and communication purposes. Hubspot tracking can, upon request when signing a contract for any of our services, be turned off for users. Turning this off will however decrease support accessibility, availability and response times.

\*\*\* **Cloudflare** operates as a network-layer provider and its servers globally handle IP addresses and metadata associated with traffic. Although Cloudflare does not store user profile data or content, IP addresses constitute personal data under GDPR. Cloudflare processing is covered by Standard Contractual Clauses. For details see: cloudflare.com/gdpr/introduction.

\*\*\*\* **Google Analytics (GA4)** is used for statistics on our public web services. Statistics for our public web services stores no personal information.

### 1.2 AI / LLM Services

Odyssey services includes AI-powered features, including a built-in chat interface. By default, no personal data is sent to AI providers. Personal data is only processed by the AI sub-processor if the user explicitly includes it in their chat input.

| Name | Location of processing* | Purpose | Transfer Mechanism |
| --- | --- | --- | --- |
| Google Cloud (Vertex AI) ** | EU | AI chat & assistant features (Claude & Gemini models) | EU–US DPF + SCCs (Google LLC) |

**\* Processing** = Every operation performed with respect to personal data, e.g. storage, collection, recording, organisation, adaptation, alteration or disclosure by transmission.

**\*\*** Odyssey's AI features, includes built-in chat interfaces, that are powered by models (Anthropic Claude and Google Gemini) hosted on Google Cloud Vertex AI, with all processing performed within the EU. No personal data is transmitted to AI services by default. Personal data is only processed if the user explicitly includes it in their chat input. Google does not use data submitted via Vertex AI to train its models. For details, see Google's Cloud Data Processing Addendum at cloud.google.com/terms/data-processing-addendum.