HEUMIX — SUBPROCESSOR LIST
Version: 2.1 — 21 October 2026
The versioned list supplied to the Customer on the acceptance date forms part of the DPA.
Identified subprocessors
Subject to the scope actually active on the signature date:
| Provider | Service | Location/transfer summary |
|---|---|---|
| Supabase, Inc. | Database, Auth, Storage, managed backend | main Heumix project configured in Stockholm, Sweden; further processing may occur under its data processing agreement |
| Vercel Inc. | Hosting, Functions, CDN | Heumix Functions configured in Stockholm; provider chain may involve processing outside the EEA |
| OpenAI Ireland Ltd. / OpenAI | AI API | EEA contracting entity; further processing may occur under the data processing agreement, standard contractual clauses and applicable adequacy decisions |
| Functional Software, Inc. (Sentry) | Observability | EU storage region selected; further processing may occur under the provider’s data processing agreement |
The versioned list supplied to the Customer prevails when a provider is added, removed or disabled.
Google and Microsoft as source services
Google and Microsoft may provide the Customer with an email inbox or calendar that the Customer chooses to connect.
The Customer authorises the connection and Heumix processes the imported copy on its behalf.
The Google connection is commercially activated only where the Google requirements applicable to the project or Customer have been satisfied.
International transfers
Heumix does not guarantee that all processing remains exclusively within the European Union.
The configuration controlled by Heumix uses in particular:
- Supabase: Stockholm, Sweden;
- Vercel Functions: Stockholm;
- Sentry: EU storage region in the observed configuration.
Some providers and their own subprocessors may process data outside the EEA.
Where required by the GDPR, Heumix relies on applicable mechanisms: an adequacy decision, standard contractual clauses or another recognised safeguard.