Sub-processors
Version 1 (Draft) Effective date: 24-08-2026
CRA Desk uses the following sub-processors to provide the service. This list may change
- see the Data Processing Agreement §3 for how a change is notified.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Infrastructure: application hosting, database, file storage, transactional email, content delivery | eu-west-1 (Ireland); CloudFront edge locations worldwide for public pages only, see below |
| Stripe | Payment processing for paid subscriptions | Sub-processor's own infrastructure, EU-region billing |
| inFakt | Invoice issuance for paid subscriptions | Poland |
| Zoho | Mailboxes for correspondence sent to the Operator's published addresses (contact@, security@, privacy@) | EU data centre |
Application data and uploaded SBOMs are stored and processed in eu-west-1 (Ireland).
CloudFront is used only to deliver the public product pages and static assets. Uploads to
the ingest endpoint pass through it in transit but are not cached at the edge and no
customer SBOM is stored outside eu-west-1.
CI platforms such as GitHub or GitLab are not sub-processors: the CRA Desk scan runs on the Customer's own CI runner and only sends its results to CRA Desk - the Operator never accesses the Customer's source repository.
The sign-up form provider referenced in the Privacy Policy §5 will be added to this list once selected.