Authorized Sub-Processors

What is a sub-processor?

A sub-processor is a third-party service provider that processes Personal Data on behalf of Rankiteo in order to deliver the Services to our customers (the "Controllers" under GDPR). Examples include cloud-infrastructure providers, CI/CD platforms, and monitoring services.

Under GDPR Article 28(4), Rankiteo binds every sub-processor by a written contract that imposes data-protection obligations equivalent to those Rankiteo owes its customers. Rankiteo remains fully liable to the customer for the performance of each sub-processor.

Key facts

• ✅ EU-only Processing. All Customer Personal Data is hosted and processed exclusively in the EEA — no data leaves the EEA in nominal Service operation.
• ✅ Limited list. Only the four sub-processors below are authorized. We have no SaaS analytics provider, no CRM provider, no advertising network in our data path.
• ✅ 30-day advance notice. If we add or replace a sub-processor, we notify customers 30 days in advance, and customers may object on data-protection grounds within 15 business days.
• ✅ Equivalent obligations. Each sub-processor is bound by written agreement to data-protection obligations equivalent to ours.
• ✅ Schrems II compliant. Our US parent entity (Rankiteo Inc.) signs SCCs Module 2 with each EU customer; a documented Transfer Impact Assessment is in place.

Get notified of changes

To be notified by email when this list changes, send a request from your DPO email to [email protected] with the subject "Subscribe to sub-processor updates". We will add your address to the notification list within 5 business days.

You may also poll this page programmatically — the "Last updated" date at the top is mirrored in the page metadata and updates each time the list changes.

Current sub-processors (4)

What we don't use (intentionally)

For full transparency, the following categories of sub-processors are not in our data path. This is a deliberate architectural choice to minimize the GDPR transfer attack surface:

• ❌ No US-hosted SaaS analytics (no Mixpanel, Amplitude, Segment in the Customer-data flow)
• ❌ No third-party advertising networks (no Google Ads / Meta Pixel)
• ❌ No CRM in the data path (no Salesforce / HubSpot processing Customer Personal Data)
• ❌ No US-hosted databases (no DynamoDB, RDS, Snowflake holding Customer data)
• ❌ No US edge / CDN for Customer-data delivery (web assets only — no cookies, no PII)

Note: external Large-Language-Model providers (OpenAI, Anthropic, DeepSeek) are only invoked when the Customer explicitly configures their own API key. In that case the Customer is the party transferring data to the LLM provider under their own DPA, not Rankiteo.

Contact