Table of contents
1. About this list
This is the current list of sub-processors under article 7.2 of the data processing agreement. A sub-processor processes personal data on behalf of ModbusCloud, for the portal, the ModbusCloud Gateway and the webshop. ModbusCloud imposes the same obligations on every sub-processor as in the data processing agreement and remains responsible to you.
A new or replacement sub-processor is listed here under Announced at least 30 days before it is engaged, with the announcement date and the earliest start date. If you also want to receive announcements by email, write to privacy@modbuscloud.com.
In the tables, DPF stands for the EU-US Data Privacy Framework and SCC for the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914).
Where the infrastructure of the portal and the gateway runs, which jurisdiction it is subject to and how ModbusCloud handles requests from governments is set out on Data location and government access.
2. Current sub-processors
| Sub-processor | Purpose | Data | Where | Transfer outside the EEA |
|---|---|---|---|---|
| Vercel Inc. (US) | Hosting of the portal and the website | Account data, session data, technical logs | Portal in Ireland (Dublin), website in the US (Washington), static files through the global Vercel network | DPF, with SCC as fallback |
| Supabase Pte. Ltd. (Singapore) | Database, sign-in and file storage | All categories of personal data from annex 1 of the data processing agreement | Ireland (AWS eu-west-1) | SCC module 3 |
| Railway Corporation (US) | Backend, such as processing readings, alert rules and scheduled jobs | All categories of personal data from annex 1 | Netherlands (Amsterdam) | DPF, with SCC as fallback |
| EMQ Technologies Incorporated (US), service EMQX Cloud | MQTT broker between the gateway and the backend | Serial numbers, readings, commands and IP address of the gateway | Germany (AWS eu-central-1, Frankfurt) | SCC module 3 |
| Stripe Payments Europe, Limited (Ireland) | Payments in the webshop | Payment and invoice data | EEA | Within the EEA |
| Google Ireland Limited (Ireland) | Signing in with a Google account | Login ID, session data | EEA | Within the EEA, Google LLC in the US through DPF |
| Microsoft Ireland Operations Limited (Ireland) | Signing in with a Microsoft account, and email to and from ModbusCloud (Exchange Online) | Login ID, session data, content of support email | EEA | Within the EEA, Microsoft Corporation in the US through DPF |
| Plus Five Five, Inc. (US), service Resend | Sending email, such as alert emails, invitations and sign-in links | Email address and content of the email, in alert emails also names of gateways and registers and readings | US | DPF, with SCC as fallback |
| MoneyBird B.V. (Netherlands) | Bookkeeping and invoices | Invoice data, such as company name, Chamber of Commerce and VAT number | Netherlands | Within the EEA |
| Anthropic Ireland, Limited (Ireland) | Language model for the automation chat and, where enabled for the organisation, the AI dashboard builder | The user's question and the names and settings of gateways, Modbus devices, registers and alert rules. No readings | US, processing elsewhere possible | SCC (Anthropic DPA) |
| OpenAI Ireland Ltd. (Ireland) | Search in the template library | Only the search text typed, without account or gateway data | US | SCC (OpenAI DPA) |
| KEPTAGO LTD (Cyprus), service Geoapify | Address completion when entering customers and gateways | The address text typed and the IP address of the browser | EU (servers at Hetzner), traffic through the Cloudflare network | Within the EEA |
| ZeroTier, Inc. (US) | Remote maintenance of the gateway, for support and servicing | Node ID and public IP address of the gateway. The maintenance traffic itself is end-to-end encrypted | US | SCC module 3 (ZeroTier DPA) |
| wherever SIM GmbH (Germany) | Mobile data connection of gateways with a ModbusCloud SIM card | ICCID, serial number of the gateway and data usage per day | Germany | Within the EEA |
3. Announced
ModbusCloud will not engage these sub-processors before the earliest start date. They are intended for storing measurement data and its archive. They hold only readings with a timestamp and technical IDs of organisation, gateway and register. Names, addresses and account data stay at Supabase.
| Sub-processor | Purpose | Where | Transfer outside the EEA | Announced on | Earliest start |
|---|---|---|---|---|---|
| ClickHouse, Inc. (US), service ClickHouse Cloud | Storage and processing of measurement data | Google Cloud europe-west4, Eemshaven (Netherlands). Management and support also from the US | DPF and SCC module 3 (ClickHouse DPA) | 15 October 2026 | 14 November 2026 |
| Scaleway SAS (France), service Data Warehouse for ClickHouse | Candidate for the same storage. Only engaged if ModbusCloud chooses Scaleway, and then instead of ClickHouse, Inc. | France (Paris) | Within the EEA | 15 October 2026 | 14 November 2026 |
| Hetzner Online GmbH (Germany) | Archive and backup of measurement data in Object Storage | Germany (Falkenstein or Nuremberg) | Within the EEA | 15 October 2026 | 14 November 2026 |
| OVH B.V. (Netherlands), service OVHcloud | Second copy of the archive in Object Storage | France | Within the EEA | 15 October 2026 | 14 November 2026 |
4. How to object
If you believe an announced sub-processor does not comply with the GDPR, object with reasons within 30 days of the announcement through privacy@modbuscloud.com. That right is in article 7.3 of the data processing agreement. Until a solution is agreed, ModbusCloud will not switch on the announced storage for your organisation.
5. Changes
| Date | Change |
|---|---|
| 15 October 2026 | List published. Compared with annex 3 of the data processing agreement, Anthropic, OpenAI, Geoapify, ZeroTier and WhereverSIM added, and the entity and location of Vercel, Supabase, Railway and Resend updated. ClickHouse, Scaleway, Hetzner and OVHcloud announced. |