Sub-processors
Last updated: 30 August 2026
These are the third parties that process personal data on our behalf when you use WhistleHub. They are the sub-processors named in Annex 3 of our Data Processing Addendum.
| Sub-processor | Role | Processing location |
|---|---|---|
| Google Cloud EMEA Limited | Cloud infrastructure and hosting: application, database, file storage and encryption keys | European Union (Belgium) |
| Google Ireland Limited — Gemini API | On-demand translation of report messages, used only when a user asks for a translation. Input is not used to train Google’s modelsAn EU-resident translation path is implemented and will replace this entry when it is enabled. | Google infrastructure, not restricted to the EU |
| Google Ireland Limited — Google Workspace | Inbound email intake for reporting addresses (WhistleMail) | European Union |
| Zone Media OÜ (veebimajutus.ee) | Outbound email delivery: notifications and invoices | Estonia |
| Infobip d.o.o. | SMS delivery, only where an organisation switches SMS notifications on | European Union (Croatia) |
| Friendly Captcha GmbH | Bot protection on the public reporting form, only where an organisation switches CAPTCHA on: the visitor’s IP address is processed to serve and verify the puzzle. No report contentVerification calls go to Friendly Captcha’s global endpoint, which is not restricted to the EU. | Germany |
When this list changes
We tell customers at least 30 days before we add or replace a sub-processor. If you object on data protection grounds within that period, we will propose an alternative, and if none is acceptable to you, you may cancel the affected part of the service and we refund the unused part of your fee. Account owners are notified by email; anyone else can ask to be added to that notice.