Documents for companies
Sub-processors
Annex 3 to the data processing agreement. We announce changes at least 30 days in advance by e-mail and on this page.
| Provider | Purpose | Data | Location of processing | Safeguards |
|---|---|---|---|---|
CloudflareCloudflare, Inc. (USA)ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701, SOC 2 Type IISecurity information ↗ | Runs the application, stores the files (R2), network, protection against attacks (DDoS) | Uploaded files and previews; technical connection data | Files: EU (storage bound to the EU jurisdiction). Requests: the nearest Cloudflare location. | DPA; EU–US Data Privacy Framework; standard contractual clauses |
SupabaseSupabase, Inc. (USA)ISO/IEC 27001, SOC 2 Type 2Security information ↗ | Database, sign-in and account management | Account data, file names and metadata, shares, lists, comments, protocols | Frankfurt am Main, Germany | DPA; standard contractual clauses for any access from outside the EU |
BrevoSendinblue SAS (France)ISO/IEC 27001Security information ↗ | Sending e-mails: notifications, invitations, sign-in and security e-mails, download links for lists | E-mail address, name, content of the e-mail (e.g. sender name, file names, link) | EU | DPA (EU company) |
HostingerHostinger International Ltd. (Cyprus)Security information ↗ | Our support mailbox (support@movemyfile.eu) | E-mails you send to us and our replies | EU; outside the EEA only with standard contractual clauses | DPA; standard contractual clauses |
Certifications (as stated by the provider).
Not sub-processors
Paddle.com (Paddle.com Market Ltd., United Kingdom) sells our paid plans as Merchant of Record. Paddle processes payment and billing data as an independent controller under its own privacy policy; MoveMyFile never sees card details.
Push notifications are delivered through the push service of your browser (e.g. Google, Apple, Mozilla). Their content is end-to-end encrypted for your device; the push service cannot read it.
Version 1.0 · as of 8 October 2026 · HSE Support Germany s.r.o.
Documents for companies
Everything your data protection officer or IT will ask for — public, current and free of charge.
- Data processing agreementUnder Art. 28 GDPR — applies automatically with our terms, free of charge
- Technical and organisational measuresWhat we actually do to protect your data (Art. 32 GDPR)
Need a countersigned copy, a security questionnaire filled in or a detailed description of our measures? Write to support@movemyfile.eu — usually answered within two working days.