Legal
Sub-processors
Last updated: 2026-10-19
CBAMWorks uses the following sub-processors to operate the service. The list is current as of the "Last updated" date at the top of this page. Changes are notified to active customer accounts by email at least 30 days before they take effect.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services (AWS) ↗ | Primary cloud provider — application hosting, Postgres database, S3-compatible object storage, networking. | EU — eu-central-1 (Frankfurt) | EU Standard Contractual Clauses; AWS GDPR DPA |
| Cloudflare ↗ | DNS, CDN, DDoS protection, Cloudflare Workers (marketing site + form webhook). | Global edge; EU-only data regions where available | EU Standard Contractual Clauses; Cloudflare GDPR DPA |
| Stripe ↗ | Payment processing and subscription management for importer plans (EUR) and the Exporter Pack (INR). | EU + US | EU Standard Contractual Clauses; Stripe DPA |
| Zoho Books ↗ | Accounting and invoicing. Stores billing contact details, VAT IDs, invoice history. | EU + India | EU Standard Contractual Clauses; Zoho DPA |
| Resend ↗ | Transactional email delivery (invitations, reminders, exports, security notifications). | EU | Resend DPA |
| OpenAI ↗ | AI-assisted bill-number extraction. Every extracted value is confirmed by the supplier before it counts toward any emissions calculation. | EU + US | EU Standard Contractual Clauses; OpenAI DPA. API data is not used to train models. |
| Meta (WhatsApp Business Cloud API) ↗ | Supplier messaging on WhatsApp — invites, reminders, support. | EU + US | EU Standard Contractual Clauses; Meta DPA |
| Plausible Analytics ↗ | Cookieless, aggregate website analytics on the marketing site. No individual user tracking. | EU — Germany | Plausible DPA |
How we assess sub-processors
- GDPR-compliant DPA in place before use.
- Where personal data leaves the EEA, Standard Contractual Clauses (and UK/CH equivalents where applicable).
- Evidence of security practice: SOC 2, ISO 27001 or equivalent public documentation.
- Data-minimisation review: we send only the data the sub-processor needs for its purpose.
- Audit, breach-notice and exit terms.
About the OpenAI integration
OpenAI is used only for one specific purpose: extracting numbers (quantity, date, unit, meter reading) from photos of fuel, electricity and production bills uploaded by suppliers. Every extracted value is confirmed by the supplier before it counts in the emissions calculation. The OpenAI API DPA excludes customer content from model training.
Changes
Material changes to this list are notified to active customers by email at least 30 days in advance. You can object on reasonable grounds; if we cannot resolve the objection, either party may terminate the main agreement without penalty.