Sub-processors
EaaS uses a small, deliberately curated set of sub-processors to deliver the platform. Each sub-processor is bound by a Data Processing Agreement (DPA) and, where the destination is outside the European Economic Area (EEA), by an additional transfer mechanism — typically the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and where applicable the EU-US Data Privacy Framework.
We notify controllers at least 30 days in advance of adding or replacing a sub-processor. Controllers may subscribe to update notifications by emailing gyjong@gmail.com. Under Art. 28(2) GDPR, controllers may object to a proposed new sub-processor during the notice period; the procedure is described at the end of this page.
Current sub-processor list
| # | Sub-processor | Role | Processing region | DPA | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | Vercel Inc. (United States) | Application hosting and edge serverless function execution. EaaS functions run in fra1 (Frankfurt, Germany). | fra1 (Frankfurt, EU); corporate entity in US | vercel.com/legal/dpa | SCCs per Vercel DPA; EU-US Data Privacy Framework (Vercel is a certified participant) |
| 2 | Neon Inc. (United States, now a Databricks company) | Managed PostgreSQL database (including pgvector). EaaS project hosted in eu-central-1 (Frankfurt). | eu-central-1 (Frankfurt, EU); corporate entity in US | neon.com/dpa (Neon Platform Services Product Specific Schedule, bundled with the Databricks Master Cloud Services Agreement post-acquisition) | SCCs per the Databricks Master Cloud Services Agreement |
| 3 | Clerk Inc. (United States) | Authentication, session management, user identity. Stores account-level identity records. | United States | clerk.com/legal/dpa | SCCs per Clerk DPA |
| 4 | Anthropic PBC (United States) | LLM inference (Claude family). Default provider for agent reasoning and draft generation. No training on customer data is contracted as the default Anthropic API setting. Tenants may opt to route inference to a self-hosted Ollama / vLLM endpoint instead, in which case Anthropic does not process the tenant's prompts at all. | United States | anthropic.com/legal/data-processing-addendum | EU SCCs Module 2 + 3 + UK Addendum + Swiss DP Laws per Anthropic DPA |
| 5 | Google LLC (United States / Ireland) | Gmail OAuth (read scope only) and Calendar API. EaaS stores only the OAuth access and refresh tokens, encrypted at application layer with AES-256-GCM. Gmail message bodies are processed transiently in memory and not persisted in Stage 1. | United States / Ireland | cloud.google.com/terms/data-processing-addendum (Cloud DPA umbrella, applies to Workspace post-consolidation) | SCCs per Google Cloud DPA; EU-US Data Privacy Framework (Google is a certified participant) |
| 6 | Resend Inc. (United States) | Outbound transactional email (account notifications, security alerts, sub-processor update notifications). Optional — used only when account features require email delivery. | United States | resend.com/legal/dpa | EU SCCs Module 2 + 3 per Resend DPA; EU-US Data Privacy Framework (Resend is U.S. Dept of Commerce certified) |
| 7 | Inngest Inc. (United States) | Background job orchestration for long-running agent workflows that exceed Vercel serverless timeouts. Receives job payloads (which may contain tenant content) during execution. | United States | DPA on request — no public DPA is published by Inngest as of 2026-05-27. EaaS will execute a private DPA before processing any non-Kenny tenant data through Inngest (contact gyjong@gmail.com for the executed copy). | SCCs to be incorporated by reference in the executed DPA |
| 8 | EnrichLayer (Singapore), successor brand to Proxycurl (formerly Nubela Pte Ltd) | LinkedIn enrichment of public-record professional profiles. Used to complete tenant-provided contact records with publicly available professional information (current role, employer, public profile URL). No private LinkedIn data is processed. | Singapore | DPA on request — the EnrichLayer Trust Center directs DPA requests to the vendor DPO by email. The corporate identity has rebranded since onboarding (Proxycurl → EnrichLayer; parent entity also changed). EaaS will reconfirm Art. 28 counterparty + execute a private DPA before processing any non-Kenny tenant data through this enrichment path. | SCCs to be incorporated by reference in the executed DPA |
Notes on processing regions
- Database and application functions are EU-resident. Neon project in Frankfurt (
eu-central-1) and Vercel functions in Frankfurt (fra1). Object storage (Vercel Blob) inherits the Vercel project region (EU). - Republic of Korea. The current platform operator (Kenny Jung) is resident in the Republic of Korea. Korea benefits from the European Commission adequacy decision (Commission Implementing Decision (EU) 2022/254 of 17 December 2021), so transfers to Korea require no additional safeguard.
- United States. All US sub-processors are covered by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) per their respective DPAs. Where the sub-processor is certified under the EU-US Data Privacy Framework, that certification provides an additional safeguard.
- Singapore. The EnrichLayer / Proxycurl successor entity will be covered by Standard Contractual Clauses in the private DPA EaaS executes with the vendor before any non-Kenny tenant data is processed through the enrichment path. Singapore does not currently hold an EU adequacy decision.
How to object to a new sub-processor
Controllers may object to a proposed new sub-processor within the 30-day notice period, under Art. 28(2) GDPR. To object:
- Email gyjong@gmail.com with subject line
Sub-processor objection — [your tenant name], identifying the sub-processor you object to and the reason (a short statement is sufficient). - EaaS will respond within 5 working days with a proposed resolution: (a) confirm an alternative sub-processor for your tenant where technically feasible, (b) postpone the change for your tenant pending mutual agreement, or (c) where neither (a) nor (b) is feasible, allow your tenant to terminate the affected service in accordance with the Terms of Service and the executed DPA without penalty, with a pro-rata refund of any prepaid fees.
How to subscribe to update notifications
Email gyjong@gmail.com with subject line Subscribe — sub-processor updates. We maintain a notification list for controllers and other interested parties and notify before each material change to the sub-processor list.
Contact
gyjong@gmail.com EaaS — Kenny (Kwang-Yong) Jung Postal address pending German GmbH formation — Munich seat
This document is preparation material drafted for review by qualified German legal counsel. It is not legal advice. Kenny must engage a Munich-based Rechtsanwalt to confirm each sub-processor's current DPA terms, SCC implementation and adequacy posture before relying on this list in dealings with paying clients. Verify each linked DPA at the source before publishing.
Sub-processors · version 1.0.1 · effective 27 May 2026. This document is published by EaaS and reviewed periodically. For questions, contact gyjong@gmail.com.