Annex II to the data processing agreement: sub-processors

List of Sub-processors at the date of publication. The first part lists the Sub-processors that process or may process Customer Data; the second, the public data services that the Platform queries and that are not Sub-processors. The column “Customer Data?” answers yes, no or possible, with the reason. Rows 5 and 6 (Sentry) are shown for transparency: Hodeitek processes the error reports as controller (clause 2.2) and Sentry is its provider for that processing, not a sub-processor of the Customer.

This annex is part of the beta data processing agreement and its terms.

1.First part. Sub-processors

No. and provider: 1. OVHcloud (OVH SAS)
Service: Managed Kubernetes, Managed PostgreSQL and Object Storage; technical logs in OVHcloud Logs Data Platform (Graylog, GELF over TLS). AI inference by the same entity (OVHcloud AI Endpoints) is listed separately, in row 7
Purpose: Host the Platform, the database and the uploaded files
Processing location: Gravelines, France (EU); logs in gra2 (Gravelines), retention of 1 year
Data received: All Customer Data stored; in the technical logs, tenant identifier, user identifier, salted hash of the IP, route, country and the text and context of each line
Customer Data?: Yes. It hosts the database, the files and the compute where all Customer Data is processed
Transfer safeguard: Within the EEA: no transfer

No. and provider: 2. Aiven Oy (Helsinki, Finland; business ID 2795743-5), further sub-processor (Hodeitek → OVHcloud → Aiven): operates the OVHcloud Managed PostgreSQL service. Hodeitek contracts OVHcloud and OVHcloud uses Aiven
Service: Platform that runs OVHcloud's managed PostgreSQL, operated remotely by Aiven.
Purpose: Run the managed database
Processing location: EU (France, Gravelines; the managed backups also in Strasbourg, France: Annex I, I.2)
Data received: The same Customer Data as the database in row 1, to the extent that Aiven has access to it
Customer Data?: Possible. The database contains all Customer Data, and Aiven may need to process it, remotely, to operate the service
Transfer safeguard: Servers in the EU; for any processing outside the EEA, standard contractual clauses under Implementing Decision (EU) 2021/914, according to Aiven's data processing agreement

No. and provider: 3. Cloudflare, Inc.
Service: DNS, content delivery network, firewall and TLS termination; Turnstile anti-bot verification of the public Trust Center; custom domains API (custom hostnames) of the Trust Centers
Purpose: Deliver and protect the Platform's traffic
Processing location: Global network; entity in the United States
Data received: All traffic in transit, which Cloudflare sees in clear because it terminates TLS at the edge and reopens it towards the origin with mutual TLS (including the Customer Data that travels in each request), with IP and technical browser data. Turnstile: the visitor's token and IP. Custom domains API: the host name that the customer wants to associate with its Trust Center
Customer Data?: Yes (TLS termination: it sees the content of requests). Possible in Turnstile (IP of visitors to the public Trust Center). No in the custom domains API (a host name, not personal in principle)
Transfer safeguard: EU-U.S. Data Privacy Framework for as long as Cloudflare, Inc. is listed as an active participant and, if it ceases to apply, Standard Contractual Clauses (Decision (EU) 2021/914)

No. and provider: 4. Resend (USA; contracting entity: Plus Five Five, Inc. (operating as Resend), 2261 Market Street #5039, San Francisco, CA, USA, according to the provider's DPA and terms of service, consulted on 2026-10-14)
Service: Transactional email API, called from n8n
Purpose: Send the Platform's emails: invitations, alerts, notices, questionnaire invitations and vulnerability notices to suppliers
Processing location: United States (main processing, according to its DPA); sending region: eu-west-1 (Ireland), measured through Resend's API and recorded by the console (2026-10-14). Amazon Web Services, Inc. is listed as a hosting and sending provider on Resend's sub-processor page (updated on 27-08-2026, verified on 2026-10-06)
Data received: Recipient's email and name (Customer's users and supplier contacts) and the content of the notice
Customer Data?: Yes. It receives the name and email of persons and the text of notices that contain Customer Data
Transfer safeguard: Resend is a US company and its DPA states that its main processing takes place in the US (clause 6.1). Safeguards according to that DPA: Standard Contractual Clauses of Decision (EU) 2021/914, module two and, if the Customer is a processor, module three (clause 6.2), and declared adherence to the EU-U.S. DPF (clause 11.1)

No. and provider: 5. Functional Software, Inc. (Sentry), for the console, the public API and the MCP server (provider of Hodeitek as controller; not a sub-processor of the Customer)
Service: Error monitoring (browser, server and edge of the console; public API and MCP server)
Purpose: Diagnose technical errors of the Platform, Hodeitek's own purpose as controller (clause 2.2)
Processing location: Storage in Sentry's EU region. Possible access from the US by Functional Software, Inc.
Data received: Filtered error reports (without user, cookies or headers; emails, IPs and secrets in the text redacted); sampled performance traces; application logs with a closed list of attributes (tenant, request, country, route, status), without user identifier or IP digest; screen replay only with an error and masked. See detail below
Customer Data?: Not as a sub-processor: Hodeitek processes these reports as controller (clause 2.2). Possible. The free text of messages and traces may contain names or Customer Data that the filter does not recognise (it removes emails, IPs, tokens and secrets, not names). The closed list of log attributes includes no data of persons
Transfer safeguard: Storage region: no transfer. Access from the US: EU-U.S. DPF and, if it does not apply, Standard Contractual Clauses, modules 2 and 3, according to Sentry's public DPA v5.1.0 (29-05-2024), https://sentry.io/legal/dpa/

No. and provider: 6. Functional Software, Inc. (Sentry), for the endpoint agent (provider of Hodeitek as controller; not a sub-processor of the Customer)
Service: Error monitoring of the agent installed on the Customer's machines
Purpose: Diagnose agent failures, Hodeitek's own purpose as controller (clause 2.2)
Processing location: Sentry's EU region. Possible access from the US as in the previous row
Data received: Only errors and failures: filtered message and trace, version, environment, operating system and kernel version, architecture. The IP of the machine's connection reaches Sentry's servers; with the project option that prevents storing IPs and Sentry's data scrubbing rule that removes the derived location, the stored event keeps neither the IP nor the city (measured on 2026-10-06). That rule is Sentry configuration and not code
Customer Data?: Not as a sub-processor: Hodeitek processes these reports as controller (clause 2.2). Possible. The agent's observations do not go to Sentry and the name of the machine and of the account are redacted, but the text of an error may contain data that the filter does not recognise; the connection IP reaches Sentry even if it is not stored
Transfer safeguard: Same as the previous row

No. and provider: 7. OVH SAS (France), the same entity as row 1
Service: OVHcloud AI Endpoints (AI inference), an API compatible with OpenAI's, through n8n, in the five flows with a model: HodeiAI, virtual CISO, policy drafting (the coverage analysis does not reach the model), risk analysis of supplier scans and classification of regulatory updates (see detail below). Service conditions: Appendix 10 (“AI Endpoints”) of OVHcloud's Specific Conditions for Public Cloud Services (OVHcloud Public Cloud, Appendix 10 (26-08-2026), pp. 52-53). OVH's sub-processors: those of its own data processing agreement; Appendix 10 does not mention them
Purpose: HodeiAI, virtual CISO, reports, policy drafting and part of the risk analysis of supplier scans
Processing location: EU (France, Gravelines, according to OVH's service documentation), service page updated on 03-02-2026, not contractual; the contract does not set a region. Under the contract, the service does not store the requests or the data, not even temporarily, except for the Batch API, which HodeiShield does not use, and OVHcloud does not reuse them, including for training models (OVHcloud Public Cloud, Appendix 10 (26-08-2026), pp. 52-53). Hodeitek's own retention of conversations: 90 days
Data received: HodeiAI and virtual CISO: the question, the last 20 messages, the tenant context and the results of the tools the agent consults (suppliers, risks, evidence, compliance), pseudonymised. Policies: the framework, category, tone, language and organisation name to write the policy, pseudonymised. Supplier scans: domain, type, score, findings and Shodan data in clear, with only a replacement by patterns of email, telephone, IBAN and DNI/NIE. Regulatory updates: public sources only
Customer Data?: Yes, while the tenant has HodeiAI enabled (all flows except regulatory updates depend on that switch). No in the classification of regulatory updates (public texts only)
Transfer safeguard: Within the EEA: OVH SAS is established in France and the location of the service is EU (France, Gravelines, according to OVH's service documentation); there is no international transfer.

No. and provider: 8. Microsoft Corporation (Microsoft 365), with Microsoft Ireland Operations Ltd. as its representative in the EEA
Service: Support, security and data protection mailboxes (info@hodeitek.com, security@hodeitek.com, privacy@hodeitek.com)
Purpose: Answering support queries and security communications by email
Processing location: Ireland (EU), within the EEA (EU Data Boundary); occasional access by Microsoft Corporation (USA)
Data received: Only what the Customer writes or attaches in the message, if it sends Customer Data through that channel; also the sender's email and name
Customer Data?: Possible. Email support may receive Customer Data if the participant pastes or attaches it
Transfer safeguard: Within the EEA for storage; occasional access from the USA relies on the EU-U.S. DPF and, as a fallback, the Standard Contractual Clauses

No. and provider: 9. UptimeRobot s. r. o. (Bratislava, Slovakia, EU)
Service: Status page and incident and maintenance notices by email to whoever subscribes: status.hodeishield.com, an UptimeRobot public status page, with the incidents and notices published by Hodeitek
Purpose: Report the status of the service and incidents, and notify by email whoever subscribes
Processing location: Primary in the EU and secondary in the USA, in data centres operated by its sub-processors (UptimeRobot DPA, Annex 1 and clause 11.1)
Data received: The monitors only check public addresses of the Platform
Customer Data?: Possible. A subscriber may be a user of the Customer; the page receives no workspace data.
Transfer safeguard: The entity is in the EU. For what is processed in the USA or other third countries, Standard Contractual Clauses (Decision (EU) 2021/914), module two or three depending on the customer's role (UptimeRobot DPA, clauses 11.2 and 11.3). UptimeRobot does not declare adherence to the EU-U.S. DPF

2.Destinations chosen by the Customer (not Sub-processors)

The services to which the Customer directs data on its own account are not Hodeitek's Sub-processors: alert destinations (Slack, Microsoft Teams, PagerDuty, Opsgenie, own webhooks, SIEM in CEF format, Jira and ServiceNow) and identity providers for single sign-on (Google, Microsoft Entra, Okta, OneLogin or its own). The Customer chooses the destination, configures it and is responsible for it; Hodeitek sends only what the Customer configures. The console's notice says the same.

3.Stripe and Holded: they appear in the console's list and do not receive Customer Data

Stripe and Holded are Hodeitek's processors for collecting and invoicing the subscription, only when it is purchased online. They receive only billing data, which Hodeitek processes as controller, and nothing from the workspace (suppliers, evidence, users). They are not Sub-processors under this agreement and therefore have no row in the first part. Billing is switched off while BILLING_ENABLED is not true, and the beta is free of charge.

4.Second part. Public data sources (not Sub-processors)

This list is distinct from the first part. The console presents it separately, as “Public security sources and logo service”: public data services to which the automation engine (n8n) sends identifiers of what is being analysed, not user accounts. They are not Sub-processors. They are declared so that the Customer knows what leaves the Platform: a company domain is not usually personal data, but it is if it identifies a natural person, and the set of what is queried reveals which suppliers and which software the Customer uses. This agreement does not state where these services process data: they are not Sub-processors and receive only what the table shows.

Second part. Public data sources (not Sub-processors)
Source	Why it is queried	What it receives	Personal data?
Shodan (`api.shodan.io`)	Measure the public exposure of the Customer's suppliers (DNS resolution and public data of the server), also in the public domain scan, with a Hodeitek credential	The supplier's domain and the IP address it resolves to, when scanning a Customer supplier and in scheduled rescans	Possible, only if the domain identifies a natural person (for example, a self-employed professional). It reveals which suppliers the Customer analyses
Have I Been Pwned (`haveibeenpwned.com`)	Detect whether a supplier domain appears in public breaches, through the public breach catalogue (`/api/v3/breaches?Domain=`)	Only the supplier's domain (parameter `Domain`) and the header `user-agent: HodeiShield/1.0`. No email address or other personal data of customers is sent.	Possible, only if the domain identifies a natural person. That is why it is not a processor: it does not receive personal data of customers on behalf of Hodeitek
OSV.dev (`api.osv.dev`)	Cross-reference the components of the SBOMs the Customer uploads with known vulnerabilities	The package identifier (purl: name, version and ecosystem) of each component, without the tenant that uploaded it	No. It is confidential information of the Customer (what software it or its supplier uses)
Logo.dev (`img.logo.dev`)	Obtain the logo of a supplier, publisher or connector	The domain of the supplier, publisher or connector	Possible, only if the domain identifies a natural person
NVD (`services.nvd.nist.gov`)	Search for CVEs of software assets (REST API 2.0, by CPE)	The CPE name of the asset's software product (vendor, product, version), in the `cpeName` parameter, without the tenant	Inventory information of the Customer (what software it uses), of the same nature as the identifiers received by OSV.dev.
FIRST EPSS (`api.first.org`)	Obtain the probability of exploitation of each CVE	The CVE identifiers	No
CISA (known exploited vulnerabilities catalogue)	Download a public list	Nothing from the Customer	No
Regulatory bulletins (BOE, EUR-Lex, ECB, EBA, ESMA, EDPB, European Commission and INCIBE)	Download public lists to classify regulatory updates	Nothing from the Customer	No

5.OVHcloud AI Endpoints detail

OVHcloud AI Endpoints detail
Flow	Depends on the HodeiAI switch	Pseudonymised	Customer Data
HodeiAI and its reports, dashboard summary and Trust Center answers	Yes	Yes, the request and the tool results	Yes
Virtual CISO	Yes	Yes	Yes
Policy drafting	Yes	Yes	Yes
Policy coverage analysis	Yes	Yes (it reaches n8n pseudonymised)	Does not reach OVHcloud AI Endpoints
Risk analysis of supplier scans	Yes, through the `ai_analysis` flag	No: request without pseudonymisation, only pattern-based replacement in the text the model receives	Yes: the supplier's domain, findings and Shodan data
Classification of regulatory updates	No (public text)	Not needed	No: public sources only

6.Sentry detail

Console, public API and MCP server:

sendDefaultPii: false in browser, server, edge, API and MCP server.
beforeSend filter: deletes the user, cookies and request headers; on server and edge it also deletes keys named after personal data in extra and tags, and finally redacts secret forms, tokens in URLs, emails and IP addresses from the text. It does not recognise the names of persons within the text of an error.
Logs sent to Sentry (enableLogs: true): a closed list of attributes (tenantId, requestId, cfRay, country, component, level, route, durationMs, statusCode, method, status, errorCode), only as text, number or boolean; everything else is discarded, and the message and texts pass through the secret and email filter. The user identifier and the salted IP digest do not go to Sentry; they do go to the internal logs and to OVHcloud Logs Data Platform (row 1).
Session replay: never in normal sessions; in production, only if there is an error, with maskAllText, maskAllInputs and blockAllMedia and with blocking of the elements with access links.
Sampled performance traces (10% in production in browser and edge; per-route sampling on server) and server profiles at 10%.
Sending from the browser through a relay of its own (POST /monitoring) that forwards only to an EU ingestion host and to the projects on the allow list, and that does not pass the browser's headers to the destination (only the content type and the encoding), so Sentry sees the IP of the console server and not that of the user.
The public API (api/) and the MCP server send only errors, without request, user, breadcrumbs or logs, also through the relay; without the project switch filled in, the relay rejects them.
How it is disabled: only Hodeitek can do so, in the deployment. Sentry sends nothing with SENTRY_ENVIRONMENT=development, but production start-up requires a configured DSN and the browser DSN is fixed when the image is built. There is no per-customer switch.

Agent:

The DSN is incorporated when the official binaries are compiled from a CI secret; for that reason the published binaries report by default.
It sends only errors, panics and certain internal anomalies of the agent; without sessions, traces, logs or metrics.
How it is disabled, in the published versions `v2.12.2` and `v2.12.3`: (1) marker file /etc/hodei-shield/telemetry-off on Linux and macOS or %ProgramData%\Hodei-Shield\telemetry-off on Windows, which prevails over any DSN and survives updates; (2) HODEI_SENTRY_DSN with the value off, false, 0, no, none, disabled or empty. It is documented in the agent installation guides. On Windows the service does not see a new machine variable until the machine is restarted, so the marker file is recommended.
In `v2.12.1` there is no marker file: disabling was a HODEI_SENTRY_DSN variable with a value that is not a valid DSN (for example off), and the machine name could reach Sentry within the text of the breadcrumbs.
Approximate location: Sentry deduces country and city from the connection IP after the event leaves the machine; no agent code can prevent this. The data scrubbing rule of the hodeishield-agent project that removes it is Sentry configuration, measured on 2026-10-06, not code.
The modules loaded on Windows are sent by file name and debug identifier, without directory.