Sub-processors
Last updated: 2026-08-12
These are the third-party service providers that may process data on our behalf in order to run NIS2Fill. We keep this page current because your own customers and auditors will ask for it - the same way you use this tool to answer their questions.
Current sub-processors
| Provider | What it does | Data it can access | Where |
|---|---|---|---|
| Supabase (Supabase Inc., hosted on AWS) | Database, authentication and file storage - the application's primary data store | All account and questionnaire data | EU - AWS eu-west-1 (Ireland) |
| Vercel (Vercel Inc.) | Application hosting and delivery | Data in transit through the application; request logs | EU region with global edge network; company established in the USA |
| OpenAI (OpenAI, L.L.C.) | Generates draft answers and text embeddings for matching questions to your stored answers | Questionnaire question text and the stored answers used to draft a response | USA |
| Sentry (Functional Software, Inc.) | Error monitoring - tells us when the application breaks so we can fix it | Technical error details: message, stack trace, the page or endpoint involved, and your organisation's internal id. Deliberately NOT questionnaire content, answer text, file uploads or email addresses | EU - Sentry's German region (de.sentry.io) |
| Google (Google Ireland Limited) | Optional "Continue with Google" sign-in. Only used if you choose it; email and password sign-in does not involve Google | Your email address and name from your Google profile, at the moment you sign in | EU establishment; Google operates globally |
| Microsoft (Microsoft Ireland Operations Limited) | Optional "Continue with Microsoft" sign-in. Only used if you choose it; email and password sign-in does not involve Microsoft | Your email address and name from your Microsoft account, at the moment you sign in | EU establishment; Microsoft operates globally |
Announced, not yet in use
These providers are listed in advance because of the 30-day notice commitment below. They are NOT processing any customer data today. Nothing moves from this table into the one above without the date being recorded here.
| Provider | What it will do | Data it will access | Where | From |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Sends the transactional emails the service needs to work: sign-up confirmation, invitations and password resets | Recipient email address and the contents of those service emails. No questionnaire content | USA | Not before 30 days after the date on this page |
Notification of changes
If we add or replace a sub-processor that processes customer data, we will update this page and notify account administrators by email at least 30 days before the change takes effect, so you have time to object.
If you object on reasonable data-protection grounds, contact us at support@nis2fill.nl and we will work with you to find a solution; if we cannot, you may terminate and export your data.
Safeguards for transfers outside the EU
Application data is stored in the EU (Ireland), and error monitoring stays in the EU (Germany). OpenAI processes data in the USA, Vercel is US-established, and Resend - once it is in use - will send email from the USA. For those transfers we rely on the European Commission's Standard Contractual Clauses and each provider's Data Processing Addendum, and where applicable the EU-US Data Privacy Framework.
Legal
Questions about this page? support@nis2fill.nl