Subprocessors
The list of subprocessors, their processing, locations and transfer mechanisms; DPA Annex C.
Published 1.0 · 2026-09-18
Effective date: 18 September 2026
Last reviewed: 2026-09-18
| Subprocessor | Processing | Location | Transfer mechanism | Status |
|---|---|---|---|---|
| Bunny.net (BunnyWay d.o.o.) | Hosting of the WebCrew platform (Magic Containers), databases and backup/CDN storage. The legacy Vedaweb server (web04) has been decommissioned; Bunny is the only infrastructure processing platform data | Slovenia (EEA), storage region Amsterdam | EEA — no transfer | Active — the current production infrastructure |
| Anthropic PBC | AI inference for agent features, under JKC Software B.V.'s own Anthropic subscription: content is processed transiently to perform requested work; no training on customer data | United States | EU–US Data Privacy Framework (see dataprivacyframework.gov for current participant status) + API data-retention terms | Active for AI features |
| Google Ireland Ltd / GitHub Inc / Microsoft Ireland | Sign-in identity verification only — they authenticate, we authorise | EU/US per provider | Adequacy / DPF per provider | Active at first login |
| Stripe Payments Europe Ltd | Payment processing and billing, under JKC Software B.V.'s own Stripe account | Ireland (EEA) | EEA; Stripe's own subprocessors per their register | Active |
| Postmark (ActiveCampaign LLC) | Email delivery for the webcrew.ai contact and plugin-request forms — one message per submission, nothing stored beyond it | United States | EU–US Data Privacy Framework / SCCs (see dataprivacyframework.gov for current participant status) | Active on the marketing site |
| Google Ireland Limited (Google Workspace) | Transactional email from the product (notifications, and the reports the Controller schedules) | Ireland (EEA) | Adequacy / EU–US Data Privacy Framework per Google's terms | Active |
| Google Ireland Limited | Analytics on the public marketing site only, through Google Tag Manager and Google Analytics 4 | Ireland (EEA), with onward transfer to Google LLC | Adequacy / EU–US Data Privacy Framework per Google's terms | Active on webcrew.ai; not loaded on proposal.jkc.media, and not loaded inside the product |
What is deliberately absent
- No analytics subprocessor inside the product. The dashboard runs no third-party analytics on customer data. The Google entry above is the public marketing site and nothing else — a distinction that matters, because it is the one an agency will check.
- Zitadel is self-hosted identity infrastructure on our own server today, not a subprocessor; it is being replaced by first-party authentication (see the auth migration packet) and never receives data beyond the hosting entry above.
- No AI training relationship. Anthropic processes content to serve each request; the API terms exclude training on our API traffic, and we do not opt in.
Change process
Additions and replacements follow DPA clause 5: thirty days' notice by email to your Account's administrative contact, objection on reasonable grounds, register updated with a dated entry. This document's git history is the change log until a hosted register page exists.