Sub-processors

Under Article 28 of the GDPR, Zillion is required to publish the list of sub-processors it engages to deliver its services. This page is the authoritative registry. We notify tenants at least 30 days before adding a new sub-processor so they may raise objections.

Stay informed

To receive email notifications when we add or remove a sub-processor, write to legal@1zill.com with the subject “Subprocessor notifications”.

Active sub-processors

NameCategoryPurposeLocationTransfer mechanismCertificationsDocuments
Anthropic
Anthropic, PBC
AI / LLMLarge language model for AI assistants, concierge, and content generation. No training on customer data.United StatesStandard Contractual Clauses (SCCs)
  • SOC 2 Type II
WebsitePrivacy policyDPA
Apache Superset (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted Superset)
Business IntelligenceBusiness intelligence dashboardsGermany (co-located with platform)Within EEA (no transfer)—
Website
Casdoor (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted Casdoor)
AuthenticationSingle Sign-On, OAuth2/OIDC identity providerGermany (co-located with platform)Within EEA (no transfer)—
WebsitePrivacy policy
ClickHouse (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted ClickHouse)
DatabaseAnalytics warehouse for BI and reportingGermany (co-located with platform)Within EEA (no transfer)—
WebsitePrivacy policy
Cloudflare
Cloudflare, Inc.
CDN & EdgeCDN, DNS, WAF, DDoS protection, R2 object storageGlobal (EU edge nodes)EU-U.S. Data Privacy Framework
  • ISO 27001
  • SOC 2 Type II
  • PCI DSS
WebsitePrivacy policyDPA
Directus (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted Directus)
CMSContent management for corporate website and legal pagesGermany (co-located with platform)Within EEA (no transfer)—
WebsitePrivacy policy
GitHub, Inc.
GitHub, Inc. (a Microsoft subsidiary)
OAuth providerOAuth2 identity provider (Sign in with GitHub)United StatesEU-U.S. Data Privacy Framework
  • ISO 27001
  • SOC 2
WebsitePrivacy policy
Google (Gemini API)
Google LLC
AI / LLMLarge language model via Google AI Studio / Vertex AIUnited States / EU region (Vertex)EU-U.S. Data Privacy Framework
  • ISO 27001
  • ISO 27017
  • ISO 27018
  • SOC 2
  • SOC 3
WebsitePrivacy policy
Google LLC
Google LLC
OAuth providerOAuth2 identity provider (Sign in with Google)United StatesEU-U.S. Data Privacy Framework
  • ISO 27001
  • ISO 27017
  • ISO 27018
  • SOC 2
  • SOC 3
WebsitePrivacy policy
Grafana / Loki / Tempo (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted)
ObservabilityLogs, metrics and traces for operational monitoringGermany (co-located with platform)Within EEA (no transfer)—
WebsitePrivacy policy
Hetzner Cloud
Hetzner Online GmbH
Cloud hostingInfrastructure hosting (VPS, databases, application servers)Germany (Falkenstein, Nuremberg)Within EEA (no transfer)
  • ISO 27001
WebsitePrivacy policy
Jitsu (self-hosted)
Zillion Technology Solutions S.L.U. (self-hosted Jitsu)
AnalyticsEvent pipeline for product analytics and attributionGermany (co-located with platform)Within EEA (no transfer)—
WebsitePrivacy policy
Microsoft Corporation
Microsoft Corporation
OAuth providerOAuth2 identity provider (Sign in with Microsoft)United StatesEU-U.S. Data Privacy Framework
  • ISO 27001
  • ISO 27018
  • SOC 2
  • SOC 3
WebsitePrivacy policy
OpenAI
OpenAI, LLC
AI / LLMLarge language model and embeddings for AI features. No training on API data (opt-out in place).United StatesStandard Contractual Clauses (SCCs)
  • SOC 2 Type II
  • ISO 27001
WebsitePrivacy policyDPA
SendGrid (Twilio)
Twilio Inc.
Email (transactional)Transactional and marketing email deliveryUnited StatesStandard Contractual Clauses (SCCs)
  • ISO 27001
  • SOC 2 Type II
WebsitePrivacy policyDPA
Stripe
Stripe Payments Europe, Ltd.
PaymentsPayment processing for SaaS billingIreland (EU entity) + United StatesStandard Contractual Clauses (SCCs)
  • PCI DSS Level 1
  • ISO 27001
  • SOC 2 Type II
WebsitePrivacy policyDPA

Change history

  • September 1, 2024 · Added
    Google (Gemini API)

    Added Google Gemini as an AI provider option via the AI abstraction layer.

  • June 1, 2024 · Added
    Anthropic

    Added Anthropic (Claude) as the default LLM for AI features.

  • June 1, 2024 · Added
    OpenAI

    Added OpenAI as an alternate LLM and for embeddings.

  • January 1, 2024 · Added
    Initial registry

    Initial list of sub-processors published at Zillion launch.

For questions about this list or to exercise your data protection rights, contact our Data Protection Officer at dpo@1zill.com.

Last updated: September 1, 2024

← Privacy PolicyData Processing Agreement (DPA) →