Sub-Processors
Vioro, operated by Cyze AS (Norway, Org. No. 932 904 500), uses a limited set of sub-processors to deliver the Service. All sub-processors are bound by a Data Processing Agreement (DPA) under GDPR Art. 28 or equivalent safeguard. Customer data is stored and processed exclusively within the EU/EEA.
This page is kept up to date. Changes are announced at least 10 days in advance by email and in-app notice, in accordance with our Data Processing Agreement.
Current Sub-Processors
| Vendor | Parent Company | Purpose | Data Location | Safeguard | Certification |
|---|---|---|---|---|---|
| Google Ireland Ltd. (Analytics) | Alphabet Inc. (USA) | Marketing website analytics | Ireland (data may transfer to US) | Google Measurement Controller-Controller Data Protection Terms + SCCs | ISO 27001, SOC 2 |
| Google Ireland Ltd. (Workspace) | Alphabet Inc. (USA) | Email (support & internal) | United States | Google Data Processing Amendment (DPA) + Standard Contractual Clauses (SCCs, Art. 46(2)(c)) | ISO 27001, SOC 2 |
| Netcup GmbH | Netcup GmbH (Germany) | Infrastructure hosting (website, database, application servers) | Germany, EU | Art. 28 GDPR AVV (Auftragsverarbeitungsvertrag) | ISO 27001 |
| Scaleway S.A.S. | Iliad Group (France) | Transactional email (alerts, IAM, notifications) | France, EU | Art. 28 GDPR DPA (v. June 2024) | ISO 27001, HDS |
| Stripe Payments Europe, Ltd. | Stripe, Inc. (USA) | Billing & subscription management | EU (Ireland) | Art. 28 GDPR DPA + SCCs (US parent) | PCI-DSS Level 1 |
Supplementary technical measure: all email is transmitted over TLS 1.2+ in transit; content is encrypted at rest within Google’s infrastructure.
Data Flows Summary
| Data Category | Processed By |
|---|---|
| Account data (name, email, organisation) | Netcup (storage), Google (support emails) |
| Billing data (Stripe customer ID, invoices) | Stripe |
| Transactional emails (alerts, notifications) | Scaleway TEM |
| Monitoring data (domains, URLs, probe results) | Netcup (storage) |
No Probes Outside the EU/EEA
All monitoring probes run from infrastructure located in Germany (Netcup). No monitoring data is routed outside the European Economic Area.
Changes to This List
We review and update this list as the Service evolves. Objections to a new sub-processor may be submitted within 10 days of notification to , per Section 5 of our DPA.
Last updated: 2026-04-06
Previous versions: vioro.io/legal/archive/