Sub-Processors
List of sub-processors that Zation works with to deliver the Platform services. This list is the canonical sub-processor list referenced in Clause 6 of the DPA and forms part of that Agreement.
| Sub-Processor | Purpose | Region |
|---|---|---|
| Microsoft Azure | Hosting, compute, storage | Switzerland North |
| Microsoft 365 | Mail, Teams, and SharePoint of the Zation team, where customer content can be handled during support and service delivery | EU |
| Microsoft Entra ID | Authentication, tenant management | Global / EU |
| Microsoft Graph API | Microsoft 365 data read access | Global / EU |
Internal tooling that is not a sub-processor
Some tools process Zation's own business data — our mail, our documents, our development work — but never customer content that we process on your behalf. Under Clause 2 of the DPA, a sub-processor is a third party engaged to process personal data on your behalf. These tools are therefore not sub-processors and are not part of the list above:
| Tool | What it processes | Why it is not a sub-processor |
|---|---|---|
| Microsoft 365 Copilot | Zation's own mail, documents, and analyses | Runs inside the Microsoft 365 tenant already listed above, under the same terms and region; it adds no new recipient of your data |
| Claude (Anthropic) | Zation's own development, documentation, and business communication | No access to Platform production data. Nobody at Zation has direct access to the production database, so no tool does either — production is reached only through audited Platform interfaces |
We state this openly rather than leaving it out: how we use AI and the rules we hold ourselves to are described in the Responsible AI Statement, and the processing of business communication is covered in our Privacy Policy.
If that ever changes — a tool gaining access to Platform data — it moves into the list above and the 30 days' notice below applies.
Change Management
Under the DPA, you provide a general authorization for Zation to engage sub-processors. Every sub-processor is bound by data protection obligations equivalent to those in the DPA. Zation maintains this list and gives you at least 30 days' advance notice of any addition or replacement.
When we plan to add or replace a sub-processor, we:
- Update this page
- Post a notice in the Platform under "Notifications"
You may object in writing on reasonable data-protection grounds within the notice period. If we cannot resolve your objection, you may terminate the affected service as set out in the DPA.
This page is the canonical sub-processor list. The detailed purposes and data categories that accompany it form part of the binding DPA.