Sub-Processors
List of sub-processors that Zation works with to deliver the Platform services. This list is the canonical sub-processor list referenced in Clause 6 of the DPA and forms part of that Agreement.
| Sub-Processor | Purpose | Processing location |
|---|---|---|
| Microsoft Azure | Hosting, compute, and storage of the Platform. All customer content and personal data is stored here; backups stay in Switzerland | Switzerland North |
| Azure Front Door | TLS termination and routing for api.platform.zation.io. Transport only: response caching is switched off on the API route, so no response is stored at an edge location | Global (anycast routing) |
| Azure Static Web Apps | Delivery of the compiled frontend of platform.zation.io: static files only (HTML, JavaScript, CSS, fonts), no personal data | West Europe |
| Microsoft Entra ID | Sign-in to the Platform, and the machine identities Zation's own services use. Sign-in is authenticated against your Entra tenant — Zation operates no directory holding your user accounts | Your own tenant (sign-in); Zation's tenant for Zation's own identities |
| Microsoft Graph API | Read-only access to the Microsoft 365 data of your tenant. Graph is an access gateway and holds no data of its own; the read result is stored in Switzerland North | Your own tenant |
| Microsoft 365 | Dispatch of Platform notification and invitation email through Zation's own tenant, and mail, Teams, and SharePoint of the Zation team, where customer content can be handled during support and service delivery | EU |
Why Azure Front Door is listed separately
Microsoft classifies Azure Front Door as a non-regional service and excludes it from the EU Data Boundary: anycast routing may carry traffic through points of presence outside Switzerland and the EEA. We list it as its own line rather than folding it into "Microsoft Azure", because the location statement differs from every other row.
What that does and does not mean for your data: caching is switched off on the API route, so nothing is stored at an edge location; TLS terminates at the nearest point of presence and the request is forwarded to the origin in Switzerland North, which accepts traffic from Front Door only. The processing is transport, not storage.
Where Microsoft Entra ID and Microsoft Graph API actually process data
These two rows previously read "Global / EU", which was too coarse to answer the question a data protection officer has to answer. In detail:
- Sign-in happens against your own Microsoft Entra tenant. The Platform is a multi-tenant Entra application; the token is issued by your tenant, no password ever reaches Zation, and Zation maintains no user store. From the validated token the Platform stores the object ID, tenant ID, user principal name, display name, email address, and Platform role — in Switzerland North.
- Graph is an access gateway to your own Microsoft tenants, not a data store. Access uses an app registration you create in your own tenant, with read-only application permissions you grant and can revoke at any time. The read result is received and stored by the Platform in Switzerland North.
- Where Microsoft itself holds that identity data is determined by the location of your tenant and by your own agreement with Microsoft, not by Zation. Switzerland is part of Microsoft's EU Data Boundary as an EFTA state. Microsoft's own documented residual transfers out of that boundary are listed in Clause 7.3 of the DPA.
Internal tooling that is not a sub-processor
Some tools process Zation's own business data — our mail, our documents, our development work — but never customer content that we process on your behalf. Under Clause 2 of the DPA, a sub-processor is a third party engaged to process personal data on your behalf. These tools are therefore not sub-processors and are not part of the list above:
| Tool | What it processes | Why it is not a sub-processor |
|---|---|---|
| Microsoft 365 Copilot | Zation's own mail, documents, and analyses | Runs inside the Microsoft 365 tenant already listed above, under the same terms and region; it adds no new recipient of your data |
| Claude (Anthropic) | Zation's own development, documentation, and business communication | No access to Platform production data. Nobody at Zation has direct access to the production database, so no tool does either — production is reached only through audited Platform interfaces |
| Cloudflare (Turnstile) | Bot protection on the public trial-registration form. Processes the IP address and browser signals of the visitor, globally | Nobody registers for a trial on your behalf: this is data of the person signing up, for which Zation is the controller, not data we process on your behalf. It is covered by the Privacy Policy rather than by this list. It is reachable only from the public trial form and from no authenticated page |
We state this openly rather than leaving it out: how we use AI and the rules we hold ourselves to are described in the Responsible AI Statement, and the processing of business communication is covered in our Privacy Policy.
If that ever changes — a tool gaining access to Platform data — it moves into the list above and the 30 days' notice below applies.
Change Management
Under the DPA, you provide a general authorization for Zation to engage sub-processors. Every sub-processor is bound by data protection obligations equivalent to those in the DPA. Zation maintains this list and gives you at least 30 days' advance notice of any addition or replacement.
When we plan to add or replace a sub-processor, we:
- Update this page
- Post a notice in the Platform under "Notifications"
You may object in writing on reasonable data-protection grounds within the notice period. If we cannot resolve your objection, you may terminate the affected service as set out in the DPA.
This page is the canonical sub-processor list. The detailed purposes and data categories that accompany it form part of the binding DPA.