Subprocessors
Subprocessors
Zoravet deliberately keeps its footprint of personal-data-processing vendors small and EU-first. The parties below process data on Zoravet's (and ultimately the clinic's) behalf under a data processing agreement.
| Vendor | Purpose | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, compute, PostgreSQL database, file storage, backups, secrets | All personal-data categories processed by the platform (client, dossier, appointment, message and invoice data) | EU region eu-central-1 (Frankfurt, Germany) | Encryption at rest and in transit, AWS standard data processing addendum |
| Amazon SES | Sending transactional and notification email | Recipient email address, message content (e.g. appointment reminder, invoice) | EU region eu-central-1 (Frankfurt, Germany) | Delivery over STARTTLS, AWS standard data processing addendum |
| Google (Firebase Cloud Messaging) | Push-notification delivery to the pet-owner app | Device push token, limited notification payload | Google LLC, US-headquartered — may process outside the EEA | Certified under the EU–U.S. Data Privacy Framework; EU Standard Contractual Clauses as fallback |
Keycloak (login) is self-hosted by Zoravet on our own EU infrastructure and is not a third-party sub-processor — it is part of our own platform.
Clinics receive at least 30 days advance notice before a new sub-processor is added or replaced, with a right to object on reasonable grounds (see the DPA §3.4).