Legal
Subprocessors
Version 1.0 · Last updated: 19 October 2026
This page lists the sub-processors that SofClo AB (“SofClo”) uses to process Customer Data on behalf of its customers in the SofClo platform. A sub-processor is a third party that SofClo engages to process personal data contained in Customer Data, as described in the Data Processing Agreement (DPA, Schedule 1 to the SofClo Master Service Agreement). By entering into the DPA, the customer authorises the sub-processors listed below. This page is the published list referred to in Section 8.1 of the DPA and prevails over Appendix 2 of the DPA in the event of any discrepancy.
1. Sub-processors of Customer Data
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxembourg | Cloud hosting, database storage, compute and application runtime for the SofClo platform, including backups. | EU – Ireland (AWS region eu-west-1) | None required – processing within the EU/EEA. AWS GDPR Data Processing Addendum. |
| Amazon Web Services EMEA SARL (Amazon Bedrock) | AI inference for the platform’s AI features (AI Management Assessment, AI Create & Write, AI Framework Recommendation, AI Management Chatbot, AI Bulk Imports). Customer Data may be sent for inference; it is not stored by Amazon Bedrock and is not used to train any model. | EU – Ireland (eu-west-1), with managed cross-region inference within the EU/EEA only | None required – processing within the EU/EEA. AWS GDPR Data Processing Addendum. |
| Amazon Web Services EMEA SARL (immutable storage) | Immutable (write-once) storage of backups and retention copies of Customer Data, kept to meet legal retention requirements, contractual obligations and the availability commitments in the SLA. Immutable copies cannot be altered or deleted before the end of their retention period. | EU – Sweden (AWS region eu-north-1, Stockholm) | None required – processing within the EU/EEA. AWS GDPR Data Processing Addendum. |
SofClo currently uses no other sub-processors for Customer Data. All Customer Data, including backups and immutable retention copies, is stored and processed within the EU/EEA (AWS regions Ireland and Stockholm).
2. How we notify changes
Before engaging a new sub-processor, or replacing an existing one, SofClo informs its customers in accordance with Section 8 of the DPA:
- by e-mail to the customer’s registered Contact Person; and
- by updating this page, including the version number and date at the top.
Customers are responsible for keeping their Contact Person details up to date with SofClo (Section 13.2 of the DPA). To check or update your Contact Person, write to customerservice@sofclo.com.
3. Right to object
If a customer has reasonable grounds to object to a new sub-processor, it must notify SofClo in writing, including by e-mail to dpo@sofclo.com, within thirty (30) calendar days of receiving the notice. If no objection is received within that period, the new sub-processor is deemed accepted. Where a customer objects, SofClo will use reasonable efforts to change the affected services or to recommend a commercially reasonable change to the customer’s use of them. If no such change can be made available within sixty (60) calendar days, the customer may terminate the part of the services that cannot be provided without the sub-processor concerned, in accordance with the DPA and the Master Service Agreement.
4. Other service providers
SofClo also uses service providers for its own business operations, such as CRM, e-mail, website hosting and accounting. These providers do not process Customer Data from the SofClo platform. SofClo is the data controller for that processing, which is described in the SofClo Privacy Notice at www.sofclo.com/privacy.
5. Contact
SofClo AB, corporate registration number 559561-4719, c/o Lundberg, Falkbergsvägen 7A, 146 40 Tullinge, Sweden.
Data Protection Officer: dpo@sofclo.com. General enquiries: customerservice@sofclo.com.