Sub-Processors
Last updated: June 12, 2026
This list is maintained in accordance with DPA § 4. Intended changes are notified at least 30 days in advance.
Scanara engages the following sub-processors to provide the platform to you. All sub-processors are contractually bound to equivalent data protection obligations (GDPR Article 28(4)).
Current Sub-Processors
| Vendor | Purpose | Data Categories Processed | Processing Location | Safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) — Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Cloud infrastructure, compute and storage (App Runner, ECS, Lambda, RDS, S3, Step Functions, SES, Cognito, CloudFront) | All account, scan, assessment, and log data processed as part of the Service | EU (Dublin, eu-west-1); CloudFront edge locations in the EU and North America | DPA with Amazon Web Services EMEA SARL; primary processing exclusively in the EU; the Standard Contractual Clauses incorporated in the AWS DPA serve as a fallback safeguard for any incidental edge or support access from third countries |
| GitHub, Inc. (Microsoft) — 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA | Source code repository access for compliance scans (on customer instruction only) and merge-gate integration (Checks API) | Repository contents and metadata, GitHub account identifiers | USA | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (Module 3); Transfer Impact Assessment (TIA) available on request |
Note on Stripe: Stripe Payments Europe, Ltd. (Ireland) acts as an independent data controller for payment data and is therefore not a sub-processor within the meaning of GDPR Art. 28. Stripe is not covered by this DPA. See Stripe's Privacy Policy for details.
Other Service Providers (not sub-processors under the DPA)
The following services process only data of visitors to the public marketing website, for which Scanara acts as controller. They do not process any customer data covered by the DPA and are loaded only after your explicit cookie consent (§ 25(1) German TDDDG).
| Vendor | Purpose | Safeguard |
|---|---|---|
| Google Analytics (GA4) — contracting entity: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; data transferred to Google LLC (USA) | Website analytics on the public marketing website (gtag.js loads only after explicit cookie consent) | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (Module 2); TIA available on request |
| Microsoft Clarity — Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA | Session replay and heatmap analytics on the public marketing website (Clarity script loads only after explicit cookie consent) | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (Module 2); TIA available on request |
Change Notifications
Intended changes to sub-processors (addition or replacement) are notified to you at least 30 days in advance by email. You have the right to raise a reasoned objection in text form (§ 126b German Civil Code — email suffices) within this period. If the parties cannot reach agreement, you are entitled to terminate the agreement extraordinarily with 30 days' notice pursuant to DPA § 4.
To object, reply to the notification email with the subject line OBJECT: [Sub-Processor Name] or write to support@scanara.io.
Legal Basis
This list is maintained pursuant to GDPR Article 28(2) and (4). All sub-processors are contractually bound to equivalent data protection obligations via written agreements. Transfer Impact Assessments (TIAs) for third-country transfers are available on request. The DPF certifications of the vendors concerned are reviewed at least annually.
Questions about sub-processing? support@scanara.io
Change Log
| Date | Change |
|---|---|
| June 12, 2026 | Google Ireland Ltd. specified as contracting entity; CloudFront, ECS, and Step Functions added to the AWS service list; addresses, data categories, and processing locations added; GA4 and Clarity moved to a separate section (not sub-processors under the DPA); objection in text form and termination terms aligned with DPA § 4; Stripe entity corrected (Stripe Payments Europe, Ltd.) |
| June 4, 2026 | Initial publication |