Sub-processors

Hosting of the applications (Cloud Run), file and document storage, delivery (load balancer, CDN), key management, logs; AI through Vertex AI (Gemini, Document AI)

All data of the applications, including personal data and documents; log data (e.g. IP addresses); for AI tasks the content each task needs

Switzerland, Zurich region (europe-west6): applications, document storage, logs. AI (Vertex AI): EU; only models Google does not offer in the EU (analysis of tickets with the Pro model) worldwide. Public file previews are cached on Google's worldwide CDN

Switzerland/EU: adequate level of protection. For Google LLC (USA) and worldwide processing: Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Database and search (run on Google Cloud)

All structured data of the applications, including personal data; search indexes

Switzerland, Zurich (Google Cloud europe-west6), including the backups

Switzerland/EU: adequate level of protection. For MongoDB, Inc. (USA): Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

AI analysis of tickets against the source code (ticket scan) and analysis of source code (Claude, through the API)

Ticket content (text, follow-up questions, submitted files), names of the people involved, company and module names, source code

USA; inputs and outputs are deleted within 30 days at the latest

Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Source code management, build and delivery; running the ticket scan

Source code; during a ticket scan, temporarily the ticket content and submitted files, and the scan report (kept for 90 days)

USA

Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Sending e-mail (sign-in codes, notifications, the applications' e-mails); can be replaced by another provider or the customer's own mail server

E-mail addresses, names, content of the e-mails

USA

Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Sending text messages (sign-in codes, notifications)

Mobile numbers, content of the messages

USA

Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Internal notification of the Omnisnap team about new and assigned tickets

Ticket number and title, company name, name of the person reporting, summary of the ticket

USA

Swiss-U.S. Data Privacy Framework or standard contractual clauses with Swiss amendments

Image and document processing for the CDN: resized images and previews of the first page of PDF documents. Cloudinary hosts no Omnisnap data; the originals stay with Google Cloud in Zurich

Uploaded images and the first page of PDF documents; these can contain personal data

EU

EU and Israel: adequate level of protection (recognised by the Swiss Federal Council)