List of Sub-processors

Verifical — Secure Document Sharing Platform
(Last updated: March 13, 2026)

This list forms part of the Data Processing Addendum (DPA) between VeroMotion s.r.o. and the Customer. It details all sub-processors authorized to process Personal Data on behalf of VeroMotion in connection with the Verifical service.

Changes to this list are communicated to Customers at least 30 days in advance in accordance with Section 9 of the DPA.

Infrastructure & Hosting

Hetzner Online GmbH

  • Data location: EU (Falkenstein / Nuremberg, Germany)
  • Purpose: Cloud hosting, object storage, server infrastructure
  • Data processed: All Customer Data (database, files)
  • Safeguards: EU-based, subject to GDPR

Amazon Web Services EMEA SARL (AWS Europe)

  • Data location: EU (Frankfurt, Germany and Dublin, Ireland)
  • Purpose: Backup storage
  • Data processed: Encrypted backups of Customer Data
  • Safeguards: EU-based, GDPR-compliant processing terms, Standard Contractual Clauses (SCCs)

Accounting & Billing Support

sehorsini s.r.o.

  • Data location: EU (Czech Republic)
  • Purpose: Accounting, invoicing, and tax support
  • Data processed: Customer names, billing data, invoice details. Does not process Personal Data for any own purposes.
  • Safeguards: EU-based, subject to GDPR

Payment Processing

Stripe, Inc. (via Stripe Payments Europe, Limited)

  • Data location: EU (Ireland)
  • Purpose: Processing subscription payments, managing payment methods, invoicing
  • Data processed: Billing data, payment card tokens, transaction records
  • Safeguards: PCI DSS Level 1 compliant, EU-based, GDPR-compliant processing terms

Wise Payments Limited

  • Data location: EU (Belgium / Estonia)
  • Purpose: Processing bank transfer payments
  • Data processed: Customer names, billing data, bank account details, transaction records
  • Safeguards: EU-based, regulated financial institution, GDPR-compliant processing terms

Emails

Amazon Web Services EMEA SARL (AWS SES)

  • Data location: EU (Frankfurt, Germany and Dublin, Ireland)
  • Purpose: Transactional email delivery (notifications, invitations, password resets)
  • Data processed: Email addresses, notification content
  • Safeguards: EU-based, GDPR-compliant processing terms, Standard Contractual Clauses (SCCs)

ActiveCampaign, LLC (Postmark)

  • Data location: US
  • Purpose: Transactional email delivery
  • Data processed: Email addresses, notification content
  • Safeguards: EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), GDPR-compliant processing terms

Plus Five Five, Inc. (Resend)

  • Data location: US with EU hosting in Ireland (eu-west-1)
  • Purpose: Ingest email processing
  • Data processed: Email addresses, received email content
  • Safeguards: EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), GDPR-compliant processing terms

Analytics & Security

Google Ireland Limited

  • Data location: EU (Ireland)
  • Purpose: Google reCAPTCHA (bot protection), Google Fonts (CDN)
  • Data processed: IP addresses, device information, browser data
  • Safeguards: EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), data minimization

AI-Assisted Processing

Microsoft Ireland Operations Limited (Azure AI)

(Only active when explicitly enabled by the Customer)

  • Data location: EU (Ireland / Sweden / Germany)
  • Purpose: Optical character recognition (OCR), data extraction, document classification
  • Data processed: Document content submitted for processing. Data is used solely to return results to the Customer and is not retained beyond the time necessary to complete the processing.
  • Safeguards: EU-based, GDPR-compliant processing terms, Standard Contractual Clauses (SCCs). VeroMotion does not permit sub-processors to use Customer Data for AI model training.

Cookie Consent Management

iubenda s.r.l.

  • Data location: EU (Italy)
  • Purpose: Managing cookie consent banners and compliance with ePrivacy Directive
  • Data processed: IP addresses (anonymized), cookie preferences, device information
  • Safeguards: EU-based, subject to GDPR

Notes

  • Sub-processors marked as “To be confirmed” will be identified before the relevant functionality is made available to Customers.
  • AI-assisted processing sub-processors are only engaged when the Customer explicitly enables these features.
  • Customers will be notified of any additions or changes to this list at least 30 days in advance by email to the address associated with their Account.
  • For questions about sub-processors, contact us at info@verifical.com.

VeroMotion s.r.o.
Karla Engliše 3208/5
Prague 5, 150 00
Czech Republic

Email: info@verifical.com
Web: https://verifical.com