Subprocessor Register
Technical disclosure. Use your browser’s print command to save this complete version as PDF.
This register identifies the providers supporting the reviewed QCM service, their purposes, relevant geography and transfer arrangements. It is incorporated into the DPA only when approved with the service order. Supplier contract acceptance and account-specific settings must be retained as evidence; this register does not claim they have been verified.
1 Hetzner Online GmbH
Entity and country: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Purpose: application and database infrastructure, attachment storage and encrypted off-host backups. Data: Customer Content and database records hosted by QCM; encrypted archives and limited infrastructure metadata.
Locations: the production host reports availability zone nbg1-dc3, Germany. The reviewed backup procedure uses a Hetzner Storage Box; its booked location still requires account evidence and must not be inferred from the application host. The approved service scope must identify that location before a fixed residency representation is made.
Safeguard: Article 28 agreement for the hosting service; no Chapter V transfer is needed for verified EEA-only processing. The Hetzner DPA and service-specific downstream providers must be checked for the booked products. Evidence reference: supplier DPA at https://www.hetzner.com/AV/DPA_en.pdf and the account’s executed agreement.
2 OpenAI Ireland Ltd and the applicable OpenAI entities
Purpose: managed AI inference for selected QCM tasks. Data: relevant contract text, user questions, drafting instructions and selected contextual information. QCM source contains a Responses adapter using store:false. The production model setting reviewed was gpt-5.4-mini; model selection is not a residency or retention guarantee.
Contracting geography: OpenAI’s current published DPA assigns EEA customers to OpenAI Ireland Ltd. Qedara’s actual contracting account and incorporated terms must be confirmed. Processing may involve the United States and other locations in OpenAI’s API subprocessor list. No EU-only project or Zero Data Retention approval was verified.
Transfer mechanism: the published OpenAI DPA section 4.1 assigns EEA data processing to OpenAI Ireland and provides for onward transfers under SCC agreements or adequacy decisions. Qedara must preserve the applicable account terms and transfer assessment. It must not claim a separately signed Qedara-to-US SCC contract merely because the standard clauses are attached to this package.
Official evidence: https://openai.com/policies/data-processing-addendum/ and https://openai.com/policies/sub-processor-list/. Supplier-level details are summarised in QCM-XFER-001.
3 Plus Five Five Inc trading as Resend
Entity and country: Plus Five Five, Inc., United States; the published contact address is 2261 Market Street #5039, San Francisco, CA 94114. Purpose: transactional email, including invitations, verification and reset messages and service notifications. Data may include recipient addresses, names, message bodies, action links and delivery events; payloads depend on the email template.
Location and mechanism: the published DPA identifies primary processing in the United States and incorporates EU SCCs, including Module 3 when the customer is a processor. Qedara must verify the applicable Resend agreement, account retention settings and actual templates. An EU sending region does not by itself establish EU-only storage or support access.
Evidence: https://resend.com/legal/dpa and https://resend.com/legal/subprocessors. The supplier’s list includes service providers in the United States. The reviewed QCM runtime has Resend configured; account-specific contractual evidence was not inspected.
4 Optional flows and register boundaries
Qedara Graph and Qedara Start are optional product flows. Their delivery and authorisation flags were not enabled in the reviewed production environment. Before enabling them, record the operating legal entity, hosting and other recipients, processing countries, payload scope and transfer mechanism. A product name alone is not a subprocessor legal entity.
BYOK uses the provider chosen and contracted by Customer where the feature is available; the production audit supplied for 18 October reported the credential vault unavailable. Do not market BYOK as presently usable without a fresh check. A customer-appointed provider may have a different legal role and must be described in the order. Public-register lookups may disclose identifiers to independent source operators; they must be assessed as recipients even when they are not subprocessors.
5 Advance notice and objections
Register owner: Qedara service owner, office@qedara.com. Before a new direct subprocessor receives Customer Personal Data, give 30 calendar days’ email notice identifying entity, country, purpose, data, start date and safeguards. Record Customer’s designated notification address at onboarding. A notice to an unmonitored website alone does not satisfy this commitment.
Customers have 15 days to raise a reasoned data protection objection. No affected processing starts while a timely objection remains unresolved. Use an alternative or allow termination of the affected service and refund unused prepaid fees. Short notice requires specific written authorisation or suspension. Record downstream supplier changes and assess whether Customer notice or a revised transfer assessment is required.
Change log: version 1.1, 19 October 2026. Adds the separate public status service and public-source recipient detail. Review every quarter and before a provider, purpose or processing-country change. Account-specific evidence gaps are expressly identified above.
6 Public status infrastructure and public sources
Cloudflare operates the independent public status service and the private erasure-receipt service. Status processing includes visitor connection data and synthetic/public probe results. The private ledger receives SHA-256 hashes of opaque workspace/user IDs, record type and timestamps, with separate production/staging credentials; it does not receive names, emails, uploaded contracts or raw IDs through this flow. Both D1 databases are provisioned with EU jurisdiction, while Worker execution, delivery and support may be global. The synthetic monitor uses a dedicated account with access only to its test workspace. The application DNS remains DNS-only. Account entity, DPA and transfer terms require retained account evidence. Supplier terms: https://www.cloudflare.com/cloudflare-customer-dpa/.
Public-source recipients: ANAF (Romania) receives Romanian fiscal identifiers and query date; the European Commission VIES service receives country and VAT number; SHAB/FOSC (Switzerland) receives company UID; The Gazette (United Kingdom) receives company number. BORME (Spain) retrieves public daily lists and performs the company-name match inside QCM. These are independent public-source services, not automatically Article 28 subprocessors. They do not receive uploaded contracts in these adapters. Source availability, logs and retention are controlled by the source operators.