Sub-processors

AuditOwl · Last updated 6 October 2026

These are the third parties that may process personal data on behalf of AuditOwl to deliver the service. We require each to provide appropriate safeguards. This list is kept current.

Current sub-processors

Provider	Purpose	Data	Location / transfer
Hostinger International Ltd (Cyprus) / UAB Hostinger (Lithuania) — VPS hosting	Provides the virtual server the application and its self-hosted PostgreSQL database run on.	Account data and all data you enter (clients, audits, documents).	EU (data centre)
Google — Gemini AI	Processes the content you submit when you use AI features (opportunity scoring, business-case refinement, solution generation and report-narrative generation). Skipped entirely when no AI key is configured (deterministic fallback).	Audit answers, pain points, opportunities and business-case inputs you submit for AI processing. No contact e-mail addresses or contact-person names are included in AI prompts.	US · EU-US DPF and/or SCCs
Stripe	Payment processing and subscription billing.	Billing identifiers and subscription status. We never store card numbers.	US/EU · EU-US DPF and/or SCCs
Resend (resend.com)	Sends verification, notification and transactional emails.	Email address and message content.	US · EU-US DPF and/or SCCs

Independent controllers & optional integrations

Google — Sign-In (OAuth): if you choose to sign in with Google, Google verifies your identity as an independent controller under its own privacy policy (email address and Google account identifier) — it does not process data on our behalf, so it is not a sub-processor.
Calendly (optional): if you connect your own Calendly account in Settings, we store the access token you provide and sync your scheduled meetings (including invitee names/emails) into your calendar. Calendly is your own vendor — you enable and can disconnect this integration at any time.

Changes

We may add or replace a sub-processor as the service evolves. Changes are announced on this page (and/or by e-mail) at least 14 days in advance; if you object on reasonable data-protection grounds within that period and no solution is found, you may terminate the affected service per the Data Processing Agreement. Absence of an objection within 14 days is deemed authorisation. Questions or objections? Email office@adaptifyaipl.com.