Like any business, we work with third-party providers and affiliated companies to help us deliver, improve, protect, and promote our services.
Third-party sub-processors
When we act as a data processor on behalf of our customers, we use third-party processors (sub-processors) that have access to certain company personal data (as defined in our Data Processing Agreement). We use these sub-processors primarily for:
- infrastructure services
- customer support
- email notifications
We require all sub-processors to use personal data only to provide services to us. Access to systems is strictly controlled under our internal security policies (aligned with ISO 27001) and protected by two-factor authentication.
Where company personal data is transferred outside the EEA or Switzerland, we rely on an adequacy decision where applicable. For transfers to the United States, we rely on the EU-US Data Privacy Framework and, for personal data governed by the Swiss FADP, on the Swiss-US Data Privacy Framework where the importer is certified. Otherwise, we rely on the European Commission’s Standard Contractual Clauses, supplemented, where applicable, by the addendum recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Infrastructure providers
Our main infrastructure provider is Microsoft, as Tresorit runs on Microsoft Azure. Because of client-side end-to-end encryption, data center administrators cannot access your encrypted content in readable form.
| Third-party provider | Purpose | Location | Sub-processors | Example data |
| Microsoft | Azure cloud storage, compute, and networking services |
Service data: Ireland (EU) Encrypted content: Ireland (EU) by default; may vary based on customer's billing country or selected data location (Data Residency Option) |
Microsoft sub-processors | Customer files and folders, account information, access logs |
Other sub-processors
| Third-party provider | Purpose | Location | Sub-processors | Example data |
| Microsoft | Application performance monitoring (APM), customer service, and product development | Ireland (EU) | Microsoft sub-processors | Registration, account and billing information, access logs |
| Twilio |
Messaging (two-factor authentication via voice and SMS) Transactional and notification emails |
San Francisco (USA) | Twilio sub-processors |
Phone number, verification messages Name, email address, email content |
| Zendesk | Customer support tools | San Francisco (USA) | Zendesk sub-processors | Email addresses, support tickets, and messages |
| HubSpot | HubSpot Marketing Hub for marketing automation and campaigns | Germany (EU) | HubSpot sub-processors | Contact data and information shared with our sales team or collected through the website |
| Salesforce | Customer relationship management (CRM) | Ireland (EU) | Salesforce sub-processors | Contact data and information shared with our sales team |
| Amazon | Simple Email Service (SES) for transactional and notification emails | Luxembourg (EU), data stored in Ireland (EU) | Amazon SES sub-processors | Name, email address, and transactional email content |
Affiliate sub-processors
Tresorit engages its affiliates as sub-processors to deliver its services. They currently operate in Hungary and Germany.
| Name | Location |
| Tresorit Kft. | Hungary |
| Tresorit GmbH | Germany |
Payment and subscription providers
To help protect your payment information, we do not store your credit card details. Instead, certified payment providers handle payment processing and billing.
Tresorit uses Zuora for automated subscription billing and invoicing. Zuora is PCI-compliant.
| Payment provider | Purpose | Example data |
| Zuora | Subscription management | Billing addresses, payment amounts, credit card details |
| Stripe | Payment processing | Billing addresses, payment amounts, credit card details |
| PayPal | Online payments | Billing addresses, payment amounts, credit card details |
Other service providers
We engage third-party companies and individuals to process certain data and support our business. These include providers of hosting, IT services, platforms, internet services, analytics, and marketing. We also work with companies that support identity verification, market research, and promotions.
Currently, these include:
| Service provider | Purpose |
| DocuSign | Electronic signatures for agreements |
| Productboard | Customer feedback management |
| HubSpot | Website hosting, marketing automation and campaigns for customers and subscribed website visitors |
|
Pardot (Salesforce) (phasing out) |
Marketing campaigns for customers and subscribed website visitors |
When required by law or for a legitimate interest, we may share your data with professional advisers acting as service providers, processors, controllers, or joint controllers, who provide consultancy, banking, legal, insurance, or accounting services. We ensure that we enter into data processing agreements with these subcontractors and implement technical and organizational measures that provide at least the same level of protection as we guarantee to our customers.
Analytics and advertising providers
We use third-party service providers on the website for analytics and advertising, in line with our Cookie Policy.