Sub-processors
This is a working draft prepared for review by qualified counsel. It is not legal advice and is not yet binding. Items in [SQUARE BRACKETS] are placeholders to be completed by REAT Global; notes marked “Counsel:” are decisions for review. See the placeholder register.
On this page
REAT Global uses the sub-processors below to provide Tractrix Cloud. This page is Annex III of the Data Processing Addendum. The desktop products and the website use no sub-processors for customer content.
Status of this list
Tractrix Cloud is in preview and its production providers have not yet been contracted. The table therefore lists the categories of sub-processor that the service will use. Vendor names, locations and transfer mechanisms marked “[to be confirmed]” will be completed before any customer data is processed in production, and the change-notice process below will apply from then on. REAT Global does not use any sub-processor that is not listed here.
Current sub-processors
| Category | Vendor | Processing location | Purpose and data | Transfer mechanism |
|---|---|---|---|---|
| Cloud hosting (compute) | [to be confirmed] | [HOSTING REGION] | Runs the application and the simulation engine; processes all Cloud data in memory | [to be confirmed] — none needed if hosted in the EEA |
| Managed database and backups | [to be confirmed] | [HOSTING REGION] | Stores account data, organisation data, customer content and audit logs; encrypted backups | [to be confirmed] |
| E-mail delivery | [to be confirmed] | [to be confirmed] | Sends verification, password-reset, invitation, security and billing e-mails; processes recipient address, subject and message body | [to be confirmed] (SCCs / UK Addendum / DPF) |
| Payments (paid plans, when launched) | [to be confirmed] | [to be confirmed] | Checkout, card processing, subscriptions and invoices; processes billing contact and payment data. Acts as an independent controller for card data and fraud prevention | [to be confirmed] |
| Customer support desk | [to be confirmed] | [to be confirmed] | Handles support e-mails and tickets; processes the correspondence and any attachments you choose to send | [to be confirmed] |
| Error monitoring | [to be confirmed] — not currently used | [to be confirmed] | Collects application errors to fix defects; configured to exclude request bodies, customer content, tokens and cookies | [to be confirmed] |
| Website hosting (static site, not Cloud) | [WEBSITE HOST] | [to be confirmed] | Serves tractrix.io; processes server logs. Not a sub-processor of customer content; listed for transparency | [to be confirmed] |
REAT Global's own staff and contractors who support the service are located in [STAFF LOCATIONS]; access to customer content from those locations is governed by the DPA and, where needed, the Standard Contractual Clauses.
How we choose sub-processors
- We assess each provider's security (for example ISO/IEC 27001 certification or a SOC 2 Type II report) and privacy practices before engaging it.
- Each provider signs a data processing agreement with obligations at least as protective as our DPA, including the Standard Contractual Clauses where data leaves the EEA, the UK or Switzerland.
- We prefer providers that can keep customer content in [HOSTING REGION] and minimise the data each provider receives.
- We remain responsible for our sub-processors' performance.
Change notices and objections
We give at least 30 days' notice before a new or replacement sub-processor processes customer personal data, by updating this page (with the date of the change in the history below) and by e-mail to:
- organisation owners and admins who switched on sub-processor change notices in Tractrix Cloud (Organisation settings → Privacy);
- owners of organisations on paid plans; and
- anyone who asks to subscribe by writing to [PRIVACY CONTACT EMAIL] with the subject “Sub-processor notices”.
Customers may object as described in section 7 of the DPA.
History
| Date | Change |
|---|---|
| 30 September 2026 | First draft listing categories only (v1.0-draft). |