Back

Sub-processors

AuditOwl · Last updated 29 July 2026

These are the third parties that may process personal data on behalf of AuditOwl to deliver the service. We require each to provide appropriate safeguards. This list is kept current.

Current sub-processors

ProviderPurposeDataLocation / transfer
Hostinger International Ltd (Cyprus) / UAB Hostinger (Lithuania) — VPS hostingProvides the virtual server the application and its self-hosted PostgreSQL database run on.Account data and all data you enter (clients, audits, documents).EU (data centre) · GDPR
Google — Gemini AIProcesses the content you submit when you use AI features (opportunity scoring, business-case refinement, solution generation and report-narrative generation). Skipped entirely when no AI key is configured (deterministic fallback).Audit answers, pain points, opportunities and business-case inputs you submit for AI processing. No contact e-mail addresses or contact-person names are included in AI prompts.US · Data Privacy Framework / SCCs
StripePayment processing and subscription billing.Billing identifiers and subscription status. We never store card numbers.US/EU · Data Privacy Framework / SCCs
Resend (resend.com)Sends verification, notification and transactional emails.Email address and message content.US · Data Privacy Framework / SCCs

Independent controllers & optional integrations

  • Google — Sign-In (OAuth): if you choose to sign in with Google, Google verifies your identity as an independent controller under its own privacy policy (email address and Google account identifier) — it does not process data on our behalf, so it is not a sub-processor.
  • Calendly (optional): if you connect your own Calendly account in Settings, we store the access token you provide and sync your scheduled meetings (including invitee names/emails) into your calendar. Calendly is your own vendor — you enable and can disconnect this integration at any time.

Changes

We may add or replace a sub-processor as the service evolves. Changes are announced on this page (and/or by e-mail) at least 14 days in advance; if you object on reasonable data-protection grounds within that period and no solution is found, you may terminate the affected service per the Data Processing Agreement. Absence of an objection within 14 days is deemed authorisation. Questions or objections? Email supportauditai@gmail.com.