Sub-processors
Updated 12 September 2026
The Swedish version is the authoritative text. This translation has not been reviewed by a lawyer.
What this list is
When a business uses Onesync, the business is the controller of data about its own clients and Onesync is the processor. To deliver the service, Onesync in turn engages sub-processors. The list below is the list the data processing agreement refers to. Customers are notified in advance when a sub-processor is added or replaced, and may object.
Sub-processors
| Provider | What they do | Where processing happens |
|---|---|---|
| Supabase, Inc. † | Database and file storage — where content, messages, bookings and customer records live. | Stockholm, Sweden (EU) |
| Vercel, Inc. † | Hosting for the websites and the API. | Frankfurt (fra1), Germany (EU) |
| Amazon Web Services EMEA SARL | The language models behind the chat and the content engine (Amazon Bedrock), and email delivery. | Frankfurt and Ireland (EU) |
| Resend, Inc. | Email delivery: confirmations, campaigns and notifications. | United States |
| Upstash, Inc. | Short-lived cache and rate limiting. Holds no messages or customer records. | United States |
| Anthropic PBC · OpenAI, L.L.C. · OpenRouter, Inc. | Language models, where a model is bought directly from the provider rather than through Amazon Bedrock. | United States |
| Nordic Technologies L.L.C-FZ | Support, development and operation of the platform on behalf of Sev Nordic AB. Staff in Dubai may need access to the production environment to resolve a fault. No data is stored in the United Arab Emirates — the access is to systems in Sweden and Germany. | Access from Dubai, United Arab Emirates (no storage there) |
| Google Ireland Limited * | Google Business Profile and Search Console, for businesses that have connected their accounts. | Ireland (EU) and the United States |
| Meta Platforms Ireland Limited · TikTok Technology Limited · Snap Group Limited * | Publishing to social channels, for businesses that have connected their accounts. | Ireland (EU) and the United States |
Those marked * are engaged only for businesses that have connected their own account to the service.
Those marked † are companies established outside the EU/EEA even where the processing itself runs inside the EU. That still counts as a transfer to a third country, because what decides the question is who is given access to the data, not where the server stands. For these, the European Commission’s Standard Contractual Clauses (Decision 2021/914) apply.
Onesync as a recipient
Onesync is operated by Sev Nordic AB (company reg. no. 559595-6052), registered office Botkyrka, Stockholms län, Sweden, for customers in the EU/EEA, and by Nordic Technologies L.L.C-FZ (licence no. 2653509.01), Meydan Free Zone, Dubai, for customers elsewhere.
Changes
The list changes when the stack changes. Customers with a current agreement are notified in advance of a change of sub-processor that handles personal data, with the opportunity to object before the change is made.