This page lists the sub-processors engaged by Sky Made Simple ApS to process Customer Personal Data in connection with the Implora platform, as required by Annex B of our Data Processing Agreement. It is generated from the agreement itself, so the two cannot drift apart.
All sub-processors are bound by Data Processing Agreements meeting GDPR Article 28 requirements, confidentiality obligations, and security measures appropriate to the risk.
| Sub-processor | Service | Data Location | Transfer Mechanism |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, databases, blob storage, automation, and Microsoft business services used to operate and support the Service | Northern Europe (EU) | EU-based; Microsoft DPA; EU Data Boundary commitment |
| Dinero | Accounting software (receives organization names only for invoice records) | Denmark (EU) | EU-based; GDPR-compliant DPA |
| Application Insights (Microsoft) | Performance monitoring, error tracking | Northern Europe (EU) | EU-based; Microsoft DPA |
| Cloudflare | Web application firewall, DDoS protection and content delivery for the Implora portal and API (processes end-user IP addresses and request metadata in transit) | Global edge network (Cloudflare, Inc., United States) | EU-US Data Privacy Framework (DPF) certified; Standard Contractual Clauses (SCCs); Cloudflare Data Processing Addendum |
| Intercom | User support and engagement platform | United States | EU-US Data Privacy Framework (DPF) certified; Standard Contractual Clauses (SCCs) as fallback; GDPR-compliant DPA |
| Anthropic | AI-assisted analysis (opt-in features). When used, tenant data from Microsoft 365 - including security configurations, operational logs, and user identifiers such as email addresses and user principal names - may be transmitted. | United States | Standard Contractual Clauses (SCCs); Anthropic does not train models on API data; 30-day data retention |
| Mailchimp (Intuit) | Email marketing and service communications | United States | EU-US Data Privacy Framework (DPF) certified; GDPR-compliant DPA |
Changes to this list
We notify customers of new or replacement sub-processors by email or platform notification at least 30 days in advance, in accordance with Section 5.3 of the Data Processing Agreement. Customers may object to a new sub-processor within 30 days of notification. Every addition and removal is recorded in the DPA document history.
Questions
For questions about this list, contact hello@implora.io.