Sub-Processor List
Last updated: January 2026
This list applies to all services provided by Sandbox Connection GmbH (“Insaio”) and supplements our Data Processing Agreement (DPA) and Privacy Policy.
We ensure that each sub-processor has signed appropriate data protection agreements under Art. 28 GDPR, and that international transfers comply with Art. 44 ff. GDPR.
| Provider | Purpose | Location / Data region | Transfer mechanism |
|---|---|---|---|
| CookieHub ehf. | Cookie consent management platform | Iceland (EU/EEA) | No third-country transfer (EEA adequate) |
| ElevenLabs Inc. | Text-to-speech generation | EU data centers (London / Frankfurt); HQ USA | EU–US DPF |
| Inngest Inc. | Event processing / job scheduling | EU where available; HQ USA | Standard Contractual Clauses (SCCs) + TIA |
| OpenAI LLC | Language model / AI processing | EU region (Azure Ireland / Netherlands); HQ USA | EU–US DPF |
| Novu Ltd. | In-app and email product notifications | EU (Germany) HQ Israel | SCCs + TIA (Israel's adequate jurisdiction) |
| Plausible Insights OÜ | Privacy-friendly analytics | EU (Estonia / Germany) | No third-country transfer |
| PostHog Inc. | Product analytics (via EU proxy) | EU region (Frankfurt); HQ UK / USA | SCCs + TIA |
| Supabase Inc. | Database & authentication backend | EU data centers (Frankfurt) | No third-country transfer |
| Stripe Payments Europe Ltd. | Payment processing | EU (Ireland); HQ USA | EU–US DPF |
| Twilio Inc. | Voice and SMS infrastructure and email delivery (SendGrid) | EU (Frankfurt / Ireland); HQ USA | EU–US DPF |
| Vercel Inc. | Hosting & content delivery (web app + website) | EU data centers (Frankfurt / Dublin); HQ USA | EU–US Data Privacy Framework (DPF) |
Notes:
- EU data centers are used wherever available.
- Third-country transfers rely on the EU–US DPF or SCCs with Transfer Impact Assessments.
- This list may be updated; customers will be notified of any material changes in advance.