Complete and continuously updated. Eight sub-processors total, each with a signed DPA. Customers receive 30 days advance notice before any change.
These four are core to delivering the Complira product. Every byte of customer audit data is stored and processed by this set, entirely within the EU.
PostgreSQL database hosting all customer AI interaction logs, review records, organisation configuration, and application data. Row-level security enforces customer isolation.
Hosts the complira.io web application and executes the API routes that ingest SDK log payloads. Serverless functions run in the Frankfurt region.
Stores dashboard user identity data: names, email addresses, password hashes, multi-factor authentication secrets, and session tokens. Separated from application data for defence-in-depth.
Sends transactional emails from the Complira application: user invitations, incident notifications, expiring token alerts, and member-joined confirmations. Does not access customer log data.
These four support our commercial and operational workflows. They never access customer audit log data — that boundary is enforced by architecture, not policy.
Stores prospect and customer contact information, sales pipeline data, and interaction history. Not connected to the Complira application database.
Microsoft 365 hosts Complira's email (thomas@complira.io, privacy@complira.io, info@complira.io), Outlook Calendar, OneDrive working documents, and Microsoft Teams meetings. Receives inbound customer and prospect correspondence. EU Data Boundary enabled for processing within the EU/EFTA region.
Used for prospect demo booking and customer meeting scheduling. Standard Contractual Clauses in place; receives only meeting invitee names and emails. Never receives customer audit log data.
Processes subscription payments and invoicing for paying customers. Stripe is Controller for payment data; Complira never sees full payment card numbers. PCI DSS Level 1 compliant.
Before adding any new sub-processor, replacing an existing one, or materially changing how an existing sub-processor handles customer data, we notify all customers at least 30 calendar days in advance.
Customers have the right to object during the notice period. If an objection cannot be resolved through alternative arrangement, the customer may terminate the affected services without penalty.
See our Trust Centre for the Sub-processor Change Notification Policy in full, or email privacy@complira.io with questions.
We're happy to share DPAs, security questionnaires, or talk through any specific data flow with your compliance team.