Home / Subprocessors
Subprocessors
Every company that can technically touch data inside gde.ee, with its purpose, the categories of data it receives, where it processes them and on what legal basis. If a provider is not listed here, it does not process your data.
Current subprocessors
| Provider | Purpose | Categories of data | Processing region | Transfer basis | Their DPA |
|---|---|---|---|---|---|
| Supabase | Database, authentication, storage, edge functions | Encrypted workspace payload, account e-mail and name, service metadata | EU — Frankfurt (eu-central-1) | Processing inside the EEA; no third-country transfer | supabase.com/legal/dpa |
| Cloudflare | CDN, WAF, DDoS protection, Workers, Turnstile, e-mail routing | IP address, request headers, security challenge signals | Global edge; EU data localisation available | EU Standard Contractual Clauses and the EU-US Data Privacy Framework | cloudflare.com/cloudflare-customer-dpa |
| Resend | Transactional e-mail (sign-up, password reset, invitations, contact form) | E-mail address, name, message text | EU/US processing | EU Standard Contractual Clauses | resend.com/legal/dpa |
| Google (Gemini API) | Optional AI company lookup from a name or registry code | Company name or registry code only — never invoice, client or contact data | United States | EU-US Data Privacy Framework and EU Standard Contractual Clauses | cloud.google.com/terms/data-processing-addendum |
| Microsoft OneDrive (optional, customer-enabled) | Storing documents in cloud storage you already own | Documents you explicitly upload | Customer's own tenant and region | You remain the controller; gde.ee only performs the transfer you request | microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA |
| Google Drive (optional, customer-enabled) | Storing documents in cloud storage you already own | Documents you explicitly upload | Customer's own account and region | You remain the controller; gde.ee only performs the transfer you request | cloud.google.com/terms/data-processing-addendum |
Direction of the data
- gde.ee → Supabase: encrypted payloads and account data, Frankfurt only.
- gde.ee → Cloudflare: request metadata at the edge; the vault payload stays opaque.
- gde.ee → Resend: outbound e-mail only, no business documents.
- gde.ee → Google Gemini: one company name or registry code per lookup, and nothing else.
- gde.ee → your OneDrive/Google Drive: only files you explicitly choose to store there.
Change policy
- 30 days' written notice to the e-mail address of every workspace administrator before a new subprocessor starts processing personal data.
- You may object within those 30 days; if we cannot accommodate the objection, you may terminate without penalty and export your data.
- Additions of purely internal tooling that never touches personal data are logged in the version history without the 30-day clock.
- Each version of this list is archived below, so an auditor can see what was true on any given date.
Who is the controller?
- Your own company account: GDE Systems OÜ is the controller for account data (e-mail, name, billing) and a processor for the business records you enter.
- Accounting agency scenario: the agency is the controller for its clients' data, gde.ee is the processor, and the agency's clients are the data subjects. The DPA covers this automatically — no separate negotiation is required for a pilot.
- Optional AI lookup: only a company name or registry code leaves our system. If you prefer that nothing leaves the EU at all, skip the AI lookup and search Äriregister directly — the register lookup itself is processed by our own worker.
Version history
| Version | Date | Change |
|---|---|---|
| v1.0 | 2026-10-14 | First public version: Supabase, Cloudflare, Resend, Google Gemini, OneDrive, Google Drive. Structure aligned with Article 28(2)–(4) GDPR. |
This page is a product and compliance document, not legal advice. Contracts, transfer mechanisms and retention periods are reviewed by Estonian counsel before they become binding.
gde.ee · Subprocessors — gde.ee · https://gde.ee/en/subprocessors/