Subprocessors and DPA
Last updated: July 8, 2026
To run fibady.com and the chat assistant we use a small number of external providers ("subprocessors") that process data on our behalf. Each of them already has its own standard Data Processing Agreement ("DPA"), automatically incorporated into their commercial terms — we don't need to sign it separately for it to be valid, and Fibady's customers don't need to sign it either: by using these services, we already operate under those DPAs. This page explains, in plain terms, who processes what and under which agreement.
1. Our role and our providers' role
When we process the data of someone who fills in the demo form, books a meeting, or uses the chat assistant, Fibady acts as the data controller. The providers in the table below act as data processors (they only process that data on our instructions, to provide their service to us).
2. Current subprocessors
| Provider | What it does | Where it processes data | Its DPA / SCCs |
|---|---|---|---|
| HubSpot | CRM, contact form, attribution tracking and meeting scheduling | EU data center (Germany), the "eu1" region we chose for our account. HubSpot states that certain analytics/product-usage data is transferred to the US, and that its staff and subprocessors may access data from other regions for support and security purposes. | legal.hubspot.com/dpa — automatically incorporated into their Terms of Service, with EU Standard Contractual Clauses for transfers outside the European Economic Area. |
| Amazon Web Services (AWS) | Infrastructure for the chat assistant's backend (Lambda function) | eu-west-1 region (Ireland), the region we chose when deploying our backend. | aws.amazon.com/compliance/gdpr-center — the DPA and EU Standard Contractual Clauses are automatically incorporated into the AWS Service Terms, with no extra steps required. |
| Anthropic | Natural language processing: generates the chat assistant's replies based on the user's message | US by default. Anthropic confirms that, as of this writing, data-at-rest storage via its API is only natively available in the US (there is no guaranteed EU-resident alternative through its direct API at this time). | anthropic.com/legal/data-processing-addendum — automatically incorporated into their Commercial Terms of Service, with EU Standard Contractual Clauses (Module Two/Three) plus UK and Swiss addenda. Anthropic does not train its models on our data or our users' data by default. |
3. International transfers
As shown above, some of these providers process or may process data outside the European Economic Area (in particular, Anthropic stores data in the US by default, and HubSpot transfers certain analytics data there). In all cases, those transfers are covered by European Commission Standard Contractual Clauses, incorporated into each provider's DPA.
4. Why no separate signature is needed
A common question: if we work with providers as large as HubSpot, AWS or Anthropic, don't we need a specific data protection contract with each one? In all three cases, no: each has solved this the same way — their standard DPA (with Standard Contractual Clauses already included) is automatically incorporated into their terms of service the moment we accept to use their product. No paper signature, no separate process with their sales or support team. This is the standard mechanism for this type of B2B provider, and it's how Fibady meets its Article 28 GDPR obligations toward each of them.
5. Are you a Fibady customer and need your own DPA?
If your company needs a specific Data Processing Agreement with Fibady as part of your own GDPR compliance, email us at contact@fibady.com and we'll sort it out.
6. Updates
Providers update their own DPAs periodically; this table reflects the status verified as of the last-updated date shown above. If we change or add a subprocessor, we'll update this page.