Infrastructure & data hosting
Transfers under the EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses.
| Subprocessor | Purpose | Location |
|---|---|---|
| MongoDB Atlas (MongoDB, Inc.) | Primary database: accounts, workspaces, cases, steps, personal accounts and document details. | [ADD: MongoDB Atlas cluster region, e.g. AWS eu-north-1 Stockholm] |
| Cloudflare, Inc. (R2 and network) | Storage of uploaded documents (R2), plus network protection for public endpoints. | Cloudflare's global storage (it may be outside the EU) |
| Application hosting | Runs the Settio app and the employee portal (app.settio.io). | [ADD: hosting provider and region of app.settio.io] |
AI provider
Data sent to the provider isn't used to train its models, under its commercial terms.
| Subprocessor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Checks which step an uploaded document belongs to, reads authority letters the team uploads, researches compliance rules, and answers questions from the help guides. In the platform and the employee portal it never receives passports, ID cards or residence permit cards: those are read on the person's device or on Settio's servers. In a free personal account it finds trips in a file or text the person sends, and reads the kind and dates of a document they put in their vault. | United States, under the EU Standard Contractual Clauses |
Email & notifications
| Subprocessor | Purpose | Location |
|---|---|---|
| Resend, Inc. | Transactional email: sign-in codes, invitations, reminders and notifications. | United States company; transfers under the EU Standard Contractual Clauses |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Deliver phone notices to employees who turn them on. A notice carries counts and a link only, never names or document types. | The provider of the person's browser |
| Sign in with Google, for people who choose it. | EU and United States | |
| Stripe | Card payments for business plans, where offered. | EU (Stripe Payments Europe) and United States |
Our website & sales (Settio as controller)
These services don't process Customer Data. They serve our own website and sales, and are listed for transparency.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the marketing website settio.io. | EU and United States |
| PostHog (EU Cloud) | Website analytics, only after a visitor accepts all cookies. Not used inside the app. | EU (Frankfurt) |
| Crisp IM SAS | The website chat, only after a visitor accepts all cookies. | EU (France) |
| HubSpot, Inc. | Receives the contact form from our server; no HubSpot script runs on the website. | EU data centre where configured; United States company |
| Cal.com, Inc. | Demo bookings (cal.eu). | EU |
| GitHub | Source code hosting and automated tests (no customer data). | United States |
Integrations you choose
When a customer connects its own tools (Slack, BambooHR, Personio, Greenhouse, Teamtailor, HiBob, or a webhook or API client), Settio sends or receives data from them on the customer’s instruction. They are the customer’s own providers, under its own agreements with them, not Settio’s subprocessors.
Change notifications
How we notify you
We give at least 30 days’ advance notice before adding a new subprocessor or materially changing the purpose of an existing one. Notifications are sent to the email on your account, posted in-product for admins, and reflected on this page.
How to subscribe
Email [email protected] with the subject line “Subprocessor updates” to be added to the notification list.
Right to object