Sub-processors
Last updated: 29 September 2026
These are the third parties that process personal data on our behalf when you use WhistleHub. They are the sub-processors named in Annex 3 of our Data Processing Addendum.
| Sub-processor | Role | Processing location |
|---|---|---|
| Google Cloud EMEA Limited | Cloud infrastructure and hosting: application, database, file storage and encryption keys | European Union (Belgium) |
| Google Ireland Limited — Gemini API | On-demand translation of report messages, used only when a user asks for a translation. Input is not used to train Google’s modelsAn EU-resident translation path is implemented and will replace this entry when it is enabled. | Google infrastructure, not restricted to the EU |
| Google Ireland Limited — Google Workspace | Email: inbound intake for reporting addresses (WhistleMail) and, since 27 September 2026, outbound delivery of notifications and invoices through the Google Workspace SMTP relay | European Union |
| Infobip d.o.o. | SMS delivery, only where an organisation switches SMS notifications on | European Union (Croatia) |
| Friendly Captcha GmbH | Bot protection on the public reporting form, only where an organisation switches CAPTCHA on: the visitor’s IP address is processed to serve and verify the puzzle. No report contentVerification calls go to Friendly Captcha’s global endpoint, which is not restricted to the EU. | Germany |
| Montonio Finance UAB | Online payment of invoices (bank link and card), used only when a customer chooses to pay online. Receives billing name, email and invoice amount | European Union (Lithuania) |
When this list changes
We tell customers at least 30 days before we add or replace a sub-processor. If you object on data protection grounds within that period, we will propose an alternative, and if none is acceptable to you, you may cancel the affected part of the service and we refund the unused part of your fee. Account owners are notified by email; anyone else can ask to be added to that notice.