Last updated: August 2026
Subprocessors
YOWO7 uses selected processors and auxiliary services to operate the platform. The list below constitutes the approved subprocessors under our Data Processing Agreement (https://www.yowo7.com/dpa). We will notify material changes with reasonable advance notice (typically at least 14 days, by email to workspace owners). The customer may object on important data-protection grounds; if the objection stands, the parties may restrict the affected service or terminate the contract.
Two layers: core systems and auxiliary services
YOWO7’s core systems (application, database, files, platform email, AI) run exclusively in the European Union on Amazon Web Services in Frankfurt (eu-central-1). That is where workspace content is stored.
In addition we use auxiliary services for payments, captcha, optional calendar connections, video calls, and mobile push. Those providers may also process data in the United States or transfer it there — even though your core data stays in the EU.
How third-country transfers are safeguarded
Where auxiliary services transfer data to the United States, we rely on EU-recognised safeguards: the EU-US Data Privacy Framework (adequacy decision for certified US companies) and/or the EU Standard Contractual Clauses (standard contracts issued by the European Commission with the recipient in the third country). Which mechanism applies depends on the provider and contract.
Current subprocessors
| Provider | Purpose | Where is data processed? |
|---|---|---|
| Amazon Web Services, Inc. / AWS EMEA | Cloud hosting and infrastructure (application, database, storage, email sending, AI, security) | EU only (Frankfurt) |
| Stripe Payments Europe / Stripe, Inc. | Payments, subscriptions, invoices | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Google Ireland Limited / Google LLC | Google Analytics 4 (marketing website only, consent); reCAPTCHA (forms); Google Calendar OAuth | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Cloudflare, Inc. | Turnstile (captcha), RealtimeKit (video calls) | EU/global and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Microsoft Ireland / Microsoft Corporation | Outlook Calendar OAuth | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Apple Inc. | APNs (iOS push notifications) | USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Google LLC (Firebase Cloud Messaging) | FCM (Android push notifications) | USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
Notes
- AWS is the hosting partner for the platform itself. Workspace content and AI run there in the EU.
- Stripe processes billing data as a payment provider; it remains part of the infrastructure used under the customer contract.
- Google Analytics and our first-party website tracking load only on the marketing website and only with cookie consent — not in the app.
- Calendar connections (Google/Microsoft) store OAuth tokens and synced events only when the customer enables the integration.
- Push services (Apple/Google) are required to deliver mobile notifications.
- There are no product-analytics services such as PostHog, Sentry, or Plausible in the platform.