SUBPROCESSOR LIST
Know which subprocessors support ZoikoSuite.
This registry identifies approved third parties that may process in-scope customer personal data on behalf of the
applicable Zoiko processor role. Scope, services, locations, and transfer context can vary by product,
deployment, jurisdiction, and customer agreement.
SCOPE & CLASSIFICATION
Not every vendor or integration is a subprocessor
Classification
Public explanation
Default treatment
Subprocessor
Third party processing in-scope customer personal data on behalf of an
applicable Zoiko processor role.
Included in the public registry when approved.
Affiliate subprocessor
Zoiko-affiliated legal entity performing in-scope processing on behalf of the
processor.
Included when legally classified — affiliation does not
exempt disclosure.
Independent controller
Third party determines its own purposes/means for a separate processing
activity.
Not labeled subprocessor; routed to relevant privacy
disclosure.
Ordinary supplier
Supplier does not process in-scope customer personal data on behalf of
ZoikoSuite.
Excluded from the subprocessor list.
Customer-selected integration
Customer independently connects a third-party service; roles depend on
configuration and contracts.
Not automatically presented as a ZoikoSuite subprocessor.
Professional adviser / authority
Legal, audit, regulator, or professional party acting under a separate role/basis.
Handled in the Privacy Policy, not automatically in this
registry.
CURRENT SUBPROCESSOR REGISTRY
Procurement-grade table — not a logo gallery
Search legal name, function, region
Service family ▾
Deployment ▾
Processing region ▾
Status ▾
Transfer status ▾
Subprocessor
Service / function
ZoikoSuite scope
Processing locations
Transfer status
Details
[ Verified legal entity ]
[ Hosting / identity / support / observability ]
[ Service family / deployment ]
[ Country/region model ]
[ status ]
View
[ Verified legal entity ]
[ Function ]
[ Scope ]
[ Region ]
[ status ]
View
SUBPROCESSOR DETAIL — STRUCTURAL EXAMPLE
Every field a reviewer needs, in one place
Field group
Content
Identity
Legal entity name; trading name; affiliate/non-affiliate classification.
Function
Service/function; purpose; dependency type.
Applicability
ZoikoSuite services/modules; deployment modes; regions; customer-specific
exceptions.
Data scope
High-level personal-data classes; special/sensitive-data status.
Location
Processing countries/regions; storage region model; remote support/access
locations if materially relevant.
Transfer context
Origin/destination context; approved mechanism state.
PROCESSING LOCATION, RESIDENCY & TRANSFER CONTEXT
Four concepts that are often incorrectly collapsed into one
Vendor headquarters
Corporate address — not proof of where customer data is processed.
Processing location
Country/region from which in-scope personal data may be stored, accessed, transmitted, or processed.
Hosting / storage region
Where relevant service data is stored — may be
customer/deployment-specific.
Data residency
Product/deployment constraint governing
storage/processing/backup/replication — source of truth is Data Residency architecture, not this list.
International transfer
Legal movement/access context across jurisdictions;
mechanism determined from approved legal analysis.
Transfer mechanism status
Approved / Not applicable / Adequacy (only if verified) /
Contractual mechanism / Customer-specific / Under review.
AUTHORIZATION & CONTRACT SAFEGUARDS
Governed by the executed DPA — never generic guidance
Area
Public treatment
Authorization model
Whether the standard DPA uses general or specific authorization —
stated only
when approved, linked to the exact DPA clause.
Change notice
Additions/replacements are communicated according to the applicable
DPA —
no invented notice period.
Opportunity to object
The contractual route and scope only — "you may veto any vendor"
language
is avoided unless the DPA actually provides that right.
Equivalent obligations
Approved subprocessor contracts are required to impose applicable
onward
data-protection obligations, without quoting confidential terms.
CHANGE & NOTICE CENTER
Proposed and effective changes, structured by type
Proposed addition
Entity, function, reason/category, planned effective date, affected service/deployment,
notice- issued date.
Proposed replacement
Outgoing entity, incoming entity, rationale category, planned effective date, migration
overlap if publishable.
Location change
Old/new processing region or rule; transfer/residency review status; effective date.
Removal / retirement
Last effective date; successor if any; historical record remains available.
OBJECTION / QUESTION ROUTE
A contractual concern route — not an implied universal veto
Step
Required behavior
1. Identify change
Deep link pre-fills the subprocessor/change ID; choose current entity or
pending change.
2. Concern category
Data protection; security; location/transfer; contractual; other.
3. DPA applicability check
System resolves the applicable DPA/version and objection clause where
possible; otherwise routes to Legal review.
4. Submission
Plain-language acknowledgement — no promise that submission suspends
vendor use unless the contract says so.
DILIGENCE & EVIDENCE
Public transparency, controlled evidence for the rest
Evidence need
Public / controlled response
Security overview
Link to the current ZoikoSuite Security Overview — no duplicated or inflated vendor security claims.
Data residency
Link to Data Residency and deployment-specific architecture.
Vendor security/privacy diligence
Public status summary only; detailed questionnaire/report through a permissioned diligence workflow.
Certifications / attestations
Only independently verified, scoped evidence — a vendor certification never becomes a ZoikoSuite certification.
Incident / breach history
Confidential vendor incident details are not exposed here — routed to the Security/Privacy process.
DEPLOYMENT & SOVEREIGN VARIANTS
List applicability changes by deployment
Multi-tenant SaaS
Standard shared-service subprocessors and region applicability from verified production topology.
Dedicated environment
Standard plus dedicated-service dependencies; excludes shared providers not used in that deployment.
Single-tenant enterprise
Applicable dedicated infrastructure/operations subprocessors, distinguishing customer-selected providers.
Sovereign / customer-controlled
May materially reduce, replace, or prohibit third-party processing — subject to legal, operational, and commercial feasibility.
Customer-managed integration
A customer's chosen downstream provider is not listed as a ZoikoSuite subprocessor unless ZoikoSuite itself engages that provider in the processing chain.
Unknown / pre-sales
Baseline public list shown with an explicit statement that final applicability is determined by the contracted service/deployment.
HISTORICAL CHANGES & VERSIONING
Prior versions preserved, never overwritten
Field
Requirement
Registry version
Stable version ID for every public release.
Before / after
Structured old and new values for changed fields.
Deep links
Old links resolve to the archived record, never a 404.
Correction log
Non-material corrections remain visible where they could affect diligence
evidence.
FREQUENTLY ASKED
Common questions
What is a ZoikoSuite subprocessor?
−
A third party approved to process in-scope customer personal data on behalf of an applicable Zoiko processor role — not every supplier or integration qualifies.
Does every customer use every subprocessor?
+
Where do subprocessors process data?
+
How will I know when the list changes?
+
Can I object to a new subprocessor?
+
Does a subprocessor's country mean my data is transferred there?
+