Sub-processors
Last Updated: October 23, 2026
What this page is
When you use Entergram to work with your customers' and leads' data, you are the data controller and we are your processor. To run the service we rely on other companies, and under Article 28 of the GDPR those companies are our sub-processors. This page lists them.
We publish it rather than sending it on request, because a list you have to ask for is not much use when you are filling in a vendor assessment at four in the afternoon.
Services you connect yourself, such as Slack, Notion, HubSpot, Zendesk, Make.com, or an AI assistant over the MCP connector, are not on this list. You choose those, you decide what they receive, and they process under their own terms rather than ours. They are covered in Section 4 of our Privacy Policy.
Current sub-processors
| Sub-processor | What it does for us | Where it processes | Transfer safeguard |
|---|---|---|---|
| Supabase | Sign-in and the account database | United States company, our project hosted in the EU | Standard Contractual Clauses |
| Stripe | Subscription billing and payments | Ireland and United States | EU customers contract with Stripe's Irish entity; Standard Contractual Clauses |
| Cloudflare | Content delivery, bot protection, and network security for both websites | United States, served from EU edge locations where possible | Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring for the application | United States | EU-US Data Privacy Framework, supported by Standard Contractual Clauses |
| Google LLC (Google Analytics) | Website and product analytics, only if you accept analytics cookies | United States | EU-US Data Privacy Framework, supported by Standard Contractual Clauses |
| Google LLC (Firebase Cloud Messaging) | Push notifications to Android devices | United States | EU-US Data Privacy Framework, supported by Standard Contractual Clauses |
| Apple Inc. (Apple Push Notification service) | Push notifications to Apple devices | Ireland and United States | Standard Contractual Clauses |
| Brevo | Sending the newsletter, if you subscribed to it | France | Processed within the EU |
| Affonso (ZASolution) | Referral attribution and the Partner Program dashboard | Germany | Processed within the EU |
| A network connectivity provider, named on request under a DPA | Carries the encrypted traffic between Entergram and Telegram for each connected account, on a dedicated route per account | The region each Telegram account is configured for | Standard Contractual Clauses where the route is outside the EU |
Why one name is missing. Publishing which network provider sits behind our customers' Telegram accounts would make those accounts easier to single out and target, which is the opposite of what the per-account routing is for. It is the only supplier we withhold. Customers who have accepted our Data Processing Agreement can have the name in confidence, and we tell them before we change it.
How we choose and manage them
- Each sub-processor is bound by a written contract that meets Article 28(3) of the GDPR.
- None of them is permitted to use your data for its own purposes, and none may use it to train a machine learning model.
- We give them the least data the job needs. Most of them never see the content of a Telegram message at all.
- We check where each one processes data and which safeguard applies before we rely on it, and we reassess when the law changes.
Changes to this list
We will give customers who have accepted our Data Processing Agreement at least 30 days' notice before we add or replace a sub-processor that processes their data. If you object on reasonable data protection grounds within that period, we will work with you to find a solution, and if we cannot, you may cancel the affected subscription and receive a pro-rata refund for the unused remainder of your current billing period.
To be told about changes, email hello@entergram.com and ask to be added to the notification list. We do not require you to have a paid plan to ask.
This page shows the date it was last changed at the top. We do not keep a running history of past versions here; if you need to evidence what the list said on a particular date, ask us and we will confirm it in writing.
Certifications and vendor reviews
We do not hold an ISO 27001 certificate or a SOC 2 report yet, and we will not imply otherwise until we do. Both are underway with Sprinto, a compliance automation platform. ISO 27001 is in progress now. We are not putting a date on it until the audit is booked. SOC 2 is signed and expected during 2027.
Sprinto helps us operate and evidence the controls. The ISO 27001 certificate itself is issued by an accredited certification body after it audits us, so until that happens we are working toward the standard rather than certified against it. This page will state the date and scope of each when it completes.
None of that should slow down your assessment. If you are evaluating Entergram and need more than this page to get a partnership approved, ask and we will provide it: our Data Processing Agreement, this list with the connectivity provider named in confidence, our security overview, a completed security questionnaire in your own format, the Standard Contractual Clauses we rely on, and our transfer assessments. We do this for customers on any plan, and where a control is not yet in place we will say so rather than tick a box we should not.
Questions
For a copy of our Data Processing Agreement, the name of the connectivity provider, a copy of the Standard Contractual Clauses we rely on, or our transfer assessment for any of the above, email hello@entergram.com.
Our Privacy Policy explains what we do with personal data, and our Terms of Service set out the controller and processor roles.
Entinel Technologies OÜ (registry code 17485993, VAT EE102977170), Pärnu mnt 139b-14, 11317 Tallinn, Estonia. Email: hello@entergram.com.