Subprocessors

Pharos uses the subprocessors below to provide the Service. They process customer personal data only on our instructions and under written agreements with data-protection terms equivalent to our DPA.

Current subprocessors

Subprocessor	Purpose	Data location	Transfer safeguard
[Hosting provider — to be confirmed]	Application servers, workers and sandbox containers	EU	Not applicable (EU)
[Managed PostgreSQL — to be confirmed]	Database and job queue	EU	Not applicable (EU)
[Object storage — to be confirmed]	Encrypted evidence and reports	EU	Not applicable (EU)
[Authentication provider — to be confirmed]	Sign-in, MFA	EU region	Not applicable (EU)
[Payment provider — to be confirmed]	Checkout, subscriptions, invoices	EU / [to be confirmed]	[SCCs or adequacy — to be confirmed]
[Email delivery — to be confirmed]	Transactional emails	EU	Not applicable (EU)
[Error tracking — to be confirmed]	Application error reports (no personal data in payloads)	EU	Not applicable (EU)

Some data sources (for example registration data services) are queried by the Service but receive only the target being looked up. They are listed in our internal source register with their terms-of-service and licence review.

Changes

We notify customers of new or replaced subprocessors at least 30 days in advance, by email and on this page. Customers may object as described in section 4 of the DPA.

To be notified about changes, or for questions, contact privacy@pharos.example.