Thoth AZ Solutions S.R.L. uses the following sub-processors to provide SENA. We notify customers by email at least 30 days before adding or replacing one, and customers may object under §6 of the Data Processing Agreement (sena.systems/dpa).
1. Sub-processors that process Customer Data
| Sub-processor | Entity and country | Service | Data | Location of processing | Safeguards |
|---|---|---|---|---|---|
| OVHcloud | OVH SAS, Roubaix, France | Managed Kubernetes (application runtime), managed PostgreSQL (databases), Object Storage (files, exports, backups), container registry | All Customer Data and account data | EU: Gravelines, France; encrypted backup copies in Germany | ISO 27001, 27017, 27018, SOC 1 and 2, HDS; OVHcloud DPA; EU only |
| TensorX | TensorX Ltd, Dublin, Ireland | AI inference: language models (DeepSeek V4.1 Flash, DeepSeek V4 Flash, Qwen 3.8 Flash), document OCR and vision (GLM-5.3 Flash), text embeddings (Qwen3-Embedding-8B) on EU GPUs | Prompts, document text and page images sent for generation, summarisation, classification, OCR and embedding | EU: Dublin (Ireland), Helsinki (Finland) | Zero data retention (no storage, no logging, no training) by contract; EU-owned entity; TensorX DPA; not yet ISO 27001 certified: compensating controls are the contractual zero retention, annual review of its security controls by SENA, and the EU-only architecture |
| Google Workspace | Google Cloud EMEA Ltd, Dublin, Ireland | Delivery of the account, notification and digest emails SENA sends from its own domain | Recipient address, name, notification text and digest summaries (which can be derived from Customer Data); no document or chat bodies | Google's infrastructure, which may be outside the EU | Google Workspace DPA; Standard Contractual Clauses; EU-US Data Privacy Framework for any US processing |
| DataImpulse | Softoria LLC, United States | Network egress for web-research page fetches | Addresses of the pages fetched and the search terms in the request; never a tenant, user or account identifier and never workspace content | Relay location not published by the provider; exit connections in Germany by default, otherwise in the country of the website fetched, which may be outside the EU | DataImpulse DPA |
Self-hosted inside our OVH environment and therefore not third-party sub-processors: Redis (cache and queues), Typesense (search index), SearXNG (search server for research features), reranking model, Infisical (secrets), GlitchTip (error tracking), Arize Phoenix (AI trace storage, 30 days), Dozzle (log viewer), SENA Ops (website and product analytics, only with consent, 13 months; country and city looked up from a location database held on our own servers).
2. Providers that process account and billing data (SENA is the controller)
| Provider | Entity and country | Service | Data | Location | Safeguards |
|---|---|---|---|---|---|
| Clerk | Clerk, Inc., San Francisco, United States | Authentication, user identity, sessions, invitations, email verification. Also holds each Organisation's user directory, which is Customer Data (DPA §12.2) | Name, email, profile image, organisation membership, login IP and timestamps | United States only (no EU region offered) | EU-US Data Privacy Framework, certified 22 February 2024 for non-HR data; Standard Contractual Clauses as fallback; Clerk DPA |
| Stripe | Stripe Payments Europe Ltd, Dublin (contracting entity); Stripe, LLC, United States (DPF-certified entity) | Subscription billing, payments, invoices, customer portal | Billing contact, company details, VAT ID, payment method (card data held by Stripe only), invoice history | EU and United States | PCI DSS Level 1; EU-US Data Privacy Framework; Standard Contractual Clauses; Stripe DPA. Stripe is an independent controller for the personal data it processes to provide its payment services (stripe.com/privacy) |
Not a sub-processor: GitHub (source code and CI). No Customer Data or account data is stored or processed there; issues and pull requests must not contain Customer Data.
3. Data sources SENA queries on the customer's instruction (they receive the query, never your identity)
| Source | What SENA does | Personal data involved |
|---|---|---|
| Public search engines queried through our self-hosted SearXNG: Bing, DuckDuckGo, Qwant, Mojeek, Brave, Startpage, Google News | Research briefs | The search terms, which can include a company or person name; sent from SENA's servers without any user, tenant or account identifier. Several engines are established in the United States; they see the terms and our server address only |
| ANAF public web services (webservicesp.anaf.ro), ONRC, mfinante.gov.ro, VIES | Company lookup by CUI at onboarding, counterparty and VAT checks, financial statements | Names and roles of legal representatives as published in public registers |
| Targetare | Romanian company-data enrichment, including administrators | Names of company administrators, company phone numbers, email addresses and websites, and the parties named in court cases, as published |
| Companies House (UK), OffeneRegister (DE), KVK (NL), BODACC and annuaire-entreprises (FR), TED and TenderNed (public procurement), GLEIF, SEC EDGAR, GDELT, Google News RSS | Company research and news for research briefs and equity news beats | Names and roles of company representatives as published; press mentions |
4. Systems the customer connects (customer's own providers, not SENA sub-processors)
Google (Drive, Calendar, Gmail where enabled), Microsoft 365 (OneDrive, Outlook Calendar, Outlook Mail), IMAP mail servers, ANAF e-Factura (SPV), Linear, Snowflake, Personio, Meta Platforms Ireland Ltd (WhatsApp Business Platform). Data flows from these systems into the customer's workspace under the customer's authorisation and the third party's own terms; these providers may send change notifications (webhooks) to SENA. SENA writes back only where the connector supports it (Google Drive, Linear, ANAF e-Factura) and the customer approves.
5. Change log
| Version | Date | Change |
|---|---|---|
| 1.2 | 28 September 2026 | Listed SENA Ops (website and product analytics, self-hosted, only with consent) among the self-hosted systems. |
| 1.1 | 27 September 2026 | First publication. |
Contact: privacy@sena.systems