These are the providers that process personal data when [Company name] runs Zeno for our customers. Each works under a data processing agreement with us that binds it to the same protections we give our customers. What the service collects is in our Privacy Policy.
Current sub-processors
| Provider | What it does | Data | Where | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosts the service: its functions, databases and file storage | Everything the service stores: identification events, device records, links, webhook deliveries, accounts | EU, Ireland (eu-west-1), with backups in the same region | Within the EEA. AWS's data processing addendum, with the Standard Contractual Clauses for any access from outside the EEA |
| Amazon CloudFront (Amazon Web Services) | Receives every request to the agent, the API and the dashboard and passes it on to the service | Requests and answers in transit, including IP addresses and device characteristics; not stored at the edge | The edge location nearest to the visitor, which can be outside the EEA; the connection is encrypted there and again on to Ireland | AWS's data processing addendum with the Standard Contractual Clauses |
| Amazon Simple Email Service (Amazon Web Services) | Sends the dashboard's emails: verification, password resets, invites and security notices | Email addresses and the emails' content | EU, Ireland (eu-west-1) | Within the EEA. AWS's data processing addendum |
| ClickHouse, Inc. (United States), ClickHouse Cloud | A searchable copy of each event for search and reports, usage records and totals, audit logs and how the dashboard is used | Events without the device characteristics: visitor ID, IP address, country, city, network, user agent, page, external ID, action, signals and score; audit entries with IP addresses | EU, on Amazon Web Services in Ireland (eu-west-1) | Stored in the EEA. ClickHouse's data processing addendum, with the Standard Contractual Clauses for any access from the United States |
| ipapi.is (Berlin, Germany) | Looks up the location and network of an IP address | The IP address only | EEA | Within the EEA |
Changes
Before a new or replacement sub-processor starts processing our customers' data, we update this page and email every customer's dashboard accounts at least 30 days in advance. A customer can object within that time by writing to [privacy contact email]. If we can't resolve the objection, the customer can stop using the service before the change takes effect and isn't billed for anything after it.
What our customers add
A customer who connects the Zeno MCP server to an AI assistant, or sends webhooks through a tunnel or another service, sends event data to that provider themselves. Those providers are the customer's processors, not ours.
Contact
Questions about our sub-processors: [privacy contact email].