Sub-Processors
This page lists the sub-processors that Docwize engages to process personal data on behalf of customers in connection with the Service. All sub-processors are bound by written agreements imposing data protection obligations equivalent in substance to those in our Data Processing Addendum.
Last Updated
This list was last updated on 14 September 2026. Docwize will notify customers of changes to this list in accordance with the Data Processing Addendum. Sub-processors marked as Feature-dependent are engaged only when Customer activates or uses the relevant feature.
| Sub-Processor | Purpose | Location | Data Processed | Data Protection Documentation | Website |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, compute, storage and related services. | Global (region-specific deployments) | Application, storage and operational data. | DPA: https://aws.amazon.com/legal/dpa/ | Visit |
| AnthropicFeature-dependent | AI language model services for document analysis, chat, agentic workflows and data extraction. | United States | Text content and document metadata submitted for AI processing. Processed solely to provide the requested AI functionality; not used to train general-purpose models. | Privacy Policy: https://www.anthropic.com/legal/privacy | Visit |
| Backblaze B2 | Cloud storage and backup services. | United States and other regions | Stored files and related metadata. | DPA: https://www.backblaze.com/company/legal/dpa | Visit |
| Castle.io | Security and risk-related services in connection with user access. | United States and European Union | Account, device and usage-related data. | DPA: https://castle.io/legal/data-processing-addendum | Visit |
| Cloudflare | Network security, DDoS protection and performance optimization. | Global | Network and traffic-related data (IP addresses, request metadata). | DPA / Trust Hub: https://www.cloudflare.com/trust-hub/gdpr/ | Visit |
| Google CloudFeature-dependent | Cloud-based document and content processing (including OCR via Cloud Vision API) and optional Google sign-in / OAuth identity services. | Global (region-specific deployments) | Document images, content and related metadata submitted for processing; identity and profile data where Google sign-in is used. | Data Processing Terms: https://cloud.google.com/terms/data-processing-terms | Visit |
| Hetzner | Cloud infrastructure and hosting services for European client environments. | European Union (Germany) | Application, storage and operational data. | DPA: https://www.hetzner.com/legal/privacy-policy | Visit |
| LY Corporation (LINE Messaging API)Feature-dependent | Customer messaging channel used to send and receive end-user messages and file attachments via the LINE Messaging API. Engaged only where Customer uses the LINE channel. | Japan | End-user message content, file attachments, and associated messaging identifiers and metadata. | Privacy Policy: https://www.lycorp.co.jp/en/company/privacypolicy/ | Visit |
| Mailgun | Transactional email delivery services. | United States and European Union | Email routing information (addresses, headers) and email content. | DPA: https://www.mailgun.com/legal/dpa/ | Visit |
| Microsoft Azure AD and Microsoft GraphFeature-dependent | Optional Azure-based identity, SSO and directory integration services. Engaged only when Customer configures Microsoft-based authentication or directory sync. | Global (region-specific deployments) | Identity and profile-related data where Microsoft-based authentication or directory integration is configured. | DPA: https://aka.ms/DPA | Visit |
| Microsoft Office for the Web (WOPI)Feature-dependent | In-browser viewing and editing of Word, Excel and PowerPoint documents in Microsoft's cloud editors via the WOPI protocol. This is a processing surface separate from Azure AD / Microsoft Graph identity services. Engaged only when Customer uses Office for the Web editing. | Global (region-specific deployments) | Document content and related metadata for documents opened or edited in Office for the Web. | DPA: https://aka.ms/DPA | Visit |
| OpenAIFeature-dependent | AI model services for document analysis, classification, extraction and related AI-enabled features. | United States | Text content and document metadata submitted for AI processing. Processed solely to provide the requested AI functionality; not used to train general-purpose models. | DPA: https://openai.com/policies/data-processing-addendum | Visit |
| RFC 3161 Timestamp Authorities (DigiCert / Sectigo / GlobalSign / Entrust / Certum)Feature-dependent | RFC 3161 trusted timestamping applied to digitally signed PDF documents. | Global | Document hashes and signing metadata. No document content is transmitted. | WebTrust for CAs / eIDAS qualified status (per authority). | Visit |
| Sentry | Application error monitoring and diagnostics. | United States and European Union | Application logs, error information and related technical metadata. | DPA: https://sentry.io/legal/dpa/ | Visit |
| SSL.comFeature-dependent | Digital document signing via eSigner CSC API; used as a fallback signing channel. | United States | Document hashes and signing metadata. No document content is transmitted. | Privacy Policy: https://www.ssl.com/privacy-policy/ | Visit |
| Strategix Cloud (VMware Cloud Director) | Primary production cloud infrastructure. Hosts the Docwize application cluster, the SQL database server and per-tenant customer databases. | South Africa (Johannesburg) | Application, database and operational data, including Customer Data held in per-tenant databases. | Data Processing Agreement in place; available on request. | Visit |
| Wasabi | Cloud object storage. | United States and other regions | Stored files and related metadata. | DPA: https://wasabi.com/legal/data-processing-addendum/ | Visit |
Amazon Web Services (AWS)
Visit WebsiteCloud infrastructure, compute, storage and related services.
Global (region-specific deployments)
Application, storage and operational data.
DPA: https://aws.amazon.com/legal/dpa/
AnthropicFeature-dependent
Visit WebsiteAI language model services for document analysis, chat, agentic workflows and data extraction.
United States
Text content and document metadata submitted for AI processing. Processed solely to provide the requested AI functionality; not used to train general-purpose models.
Privacy Policy: https://www.anthropic.com/legal/privacy
Backblaze B2
Visit WebsiteCloud storage and backup services.
United States and other regions
Stored files and related metadata.
DPA: https://www.backblaze.com/company/legal/dpa
Castle.io
Visit WebsiteSecurity and risk-related services in connection with user access.
United States and European Union
Account, device and usage-related data.
DPA: https://castle.io/legal/data-processing-addendum
Cloudflare
Visit WebsiteNetwork security, DDoS protection and performance optimization.
Global
Network and traffic-related data (IP addresses, request metadata).
DPA / Trust Hub: https://www.cloudflare.com/trust-hub/gdpr/
Google CloudFeature-dependent
Visit WebsiteCloud-based document and content processing (including OCR via Cloud Vision API) and optional Google sign-in / OAuth identity services.
Global (region-specific deployments)
Document images, content and related metadata submitted for processing; identity and profile data where Google sign-in is used.
Data Processing Terms: https://cloud.google.com/terms/data-processing-terms
Hetzner
Visit WebsiteCloud infrastructure and hosting services for European client environments.
European Union (Germany)
Application, storage and operational data.
DPA: https://www.hetzner.com/legal/privacy-policy
LY Corporation (LINE Messaging API)Feature-dependent
Visit WebsiteCustomer messaging channel used to send and receive end-user messages and file attachments via the LINE Messaging API. Engaged only where Customer uses the LINE channel.
Japan
End-user message content, file attachments, and associated messaging identifiers and metadata.
Privacy Policy: https://www.lycorp.co.jp/en/company/privacypolicy/
Mailgun
Visit WebsiteTransactional email delivery services.
United States and European Union
Email routing information (addresses, headers) and email content.
DPA: https://www.mailgun.com/legal/dpa/
Microsoft Azure AD and Microsoft GraphFeature-dependent
Visit WebsiteOptional Azure-based identity, SSO and directory integration services. Engaged only when Customer configures Microsoft-based authentication or directory sync.
Global (region-specific deployments)
Identity and profile-related data where Microsoft-based authentication or directory integration is configured.
DPA: https://aka.ms/DPA
Microsoft Office for the Web (WOPI)Feature-dependent
Visit WebsiteIn-browser viewing and editing of Word, Excel and PowerPoint documents in Microsoft's cloud editors via the WOPI protocol. This is a processing surface separate from Azure AD / Microsoft Graph identity services. Engaged only when Customer uses Office for the Web editing.
Global (region-specific deployments)
Document content and related metadata for documents opened or edited in Office for the Web.
DPA: https://aka.ms/DPA
OpenAIFeature-dependent
Visit WebsiteAI model services for document analysis, classification, extraction and related AI-enabled features.
United States
Text content and document metadata submitted for AI processing. Processed solely to provide the requested AI functionality; not used to train general-purpose models.
DPA: https://openai.com/policies/data-processing-addendum
RFC 3161 Timestamp Authorities (DigiCert / Sectigo / GlobalSign / Entrust / Certum)Feature-dependent
Visit WebsiteRFC 3161 trusted timestamping applied to digitally signed PDF documents.
Global
Document hashes and signing metadata. No document content is transmitted.
WebTrust for CAs / eIDAS qualified status (per authority).
Sentry
Visit WebsiteApplication error monitoring and diagnostics.
United States and European Union
Application logs, error information and related technical metadata.
DPA: https://sentry.io/legal/dpa/
SSL.comFeature-dependent
Visit WebsiteDigital document signing via eSigner CSC API; used as a fallback signing channel.
United States
Document hashes and signing metadata. No document content is transmitted.
Privacy Policy: https://www.ssl.com/privacy-policy/
Strategix Cloud (VMware Cloud Director)
Visit WebsitePrimary production cloud infrastructure. Hosts the Docwize application cluster, the SQL database server and per-tenant customer databases.
South Africa (Johannesburg)
Application, database and operational data, including Customer Data held in per-tenant databases.
Data Processing Agreement in place; available on request.
Wasabi
Visit WebsiteCloud object storage.
United States and other regions
Stored files and related metadata.
DPA: https://wasabi.com/legal/data-processing-addendum/
Questions?
If you have any questions about our sub-processors or data processing practices, please contact us.
Contact Us