Subprocessor List
IN FORCE. See 00-README. This is the authoritative subprocessor list referenced by the Privacy Policy and the DPA (it populates DPA Annex IV / SCC Annex III).
Legal basis. Every provision below rests on one of three things: a measured fact about the platform (cited to file and line), a rule of law (cited to the instrument and article in the Legal Basis Register), or a commercial choice CIQRA has made where the law leaves it open. Prepared and adopted by CIQRA OÜ.
Controller/Processor: CIQRA OÜ, registry code 16465907, Veskiposti tn 2, Kesklinna linnaosa, Tallinn, Harju maakond, 10138, Estonia · privacy@ciqra.com In force from: 2026-08-09 · Version: 1.0 · Adopted by: CIQRA OÜ
0. What was measured, and what a source-code measurement cannot tell you
This list was reconciled against the platform source tree on 2026-08-09 (lane/L @ 81807dc44). That reconciliation is authoritative for one direction only:
- ✅ A provider wired into the code is really engaged. If a client, endpoint or service registration exists, that party receives data when the feature runs.
- ⚠️ Source code cannot establish a hosting region, a contracting entity, or an executed DPA. Those are deployment and contract facts. Where this list states a region or a legal entity, that value is carried forward from an earlier internal version and has not been independently verified here — it is marked accordingly.
- 🔴 A row removed below was removed because the integration does not exist in the code, not because a contract was cancelled.
Three corrections resulted, all of which change what merchants and regulators are told:
| # | Correction | Basis |
|---|---|---|
| 1 | Voyage AI and fal.ai added as AI subprocessors — both were entirely absent from this list | AiServiceCollectionExtensions.cs:94,96,99,102 |
| 2 | Amazon SES row removed — no SES client, package or sender exists; the only production email sender is Azure Communication Services | AcsEmailSender.cs:13; grep -rn 'SES|SimpleEmail' src/ → no implementation |
| 3 | "Self-hosted AI gateway on Azure" claim removed — AI traffic goes directly to the provider APIs | AnthropicChatClientFactory.cs:30-40; AiServiceCollectionExtensions.cs:77,87 |
1. How to read this list
- CIQRA engages the third parties below to process personal data on its behalf (as subprocessors where CIQRA is a processor for Merchant data, or as processors where CIQRA is a controller for its own data).
- Core hosting is EU-native. Compute, database, storage and secrets run on Microsoft Azure in Germany (Germany West Central / Germany North). For those, there is no transfer of personal data outside the EU/EEA for core processing.
- SCCs are needed for the non-EEA-touching providers — Stripe's US flows, all four AI providers, and Cloudflare's US parent. Those rows are marked "SCCs".
- Stripe acts largely as an independent controller/processor for payment data under its own terms, not merely as CIQRA's subprocessor.
- Consent-based recipients (ad/analytics platforms) and Merchant-opted-in recipients process personal data only where the relevant Merchant/end-user has enabled them; for those the Merchant is typically the controller.
- "SCCs" = EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), plus UK IDTA/Addendum and Swiss amendments where relevant; CIQRA maintains a Transfer Impact Assessment for restricted transfers (DPA §11.2).
2. Core platform subprocessors (always engaged)
| # | Subprocessor (legal entity) | Purpose / service | Personal data | Location | Transfer basis |
|---|---|---|---|---|---|
| 1 | Microsoft Azure (Microsoft Ireland Operations Ltd / Microsoft Corp.) — Container Apps (compute), Database for PostgreSQL Flexible Server (data), Blob Storage (media), Key Vault (secrets/keys) | Hosting, compute, database, media storage, secrets/key management | All hosted platform data | EU — Germany West Central (Frankfurt) primary; Germany North paired DR | Intra-EEA for core processing; SCCs for any US-parent support access |
| 2 | Cloudflare, Inc. | CDN, DNS, WAF, DDoS mitigation, bot protection, merchant custom hostnames. 🔴 Added 2026-08-10: Cloudflare Web Analytics ("Insights"). cloudflareinsights/beacon.min.js runs on storefront pages and was missing from this list — because it is injected at the edge, not by the application: the origin HTML contains zero occurrences, while the browser's document.scripts contains it. It is analytics, and analytics is not strictly necessary under ePrivacy Art. 5(3) (register 1.6). ⚠️ It cannot be switched off in code — it is a Cloudflare panel setting. PA-0371; see Cookie Policy §4.2. | Traffic metadata, IP, request headers; plus page/navigation telemetry via Insights | Global edge; EU data-localization applied to EU traffic (not verified here) | SCCs (US entity). 🔴 Insights additionally needs an Art. 5(3) consent basis, which is not in place |
| 3 | Microsoft — Azure Communication Services (ACS) Email | Transactional email delivery — the only production email sender (measured: ciqra-saas/src/Ciqra.Api/Email/AcsEmailSender.cs:13, "EU Data boundary") | Recipient email, name, message content | EU (Germany/EU region) | Intra-EEA; SCCs for any US-parent access |
| 4 | Grafana Labs — Grafana Cloud (EU) | Observability — metrics, logs, traces via OpenTelemetry OTLP (measured: Ciqra.Api.csproj:81-85) | Telemetry, limited PII (IP, user/tenant id) | EU region (deployment config, not verified here) | Intra-EEA; SCCs if US access |
| 5 | Functional Software, Inc. — Sentry (EU region) | Error monitoring / crash diagnostics (measured: Ciqra.Api.csproj:86 Sentry.AspNetCore) | Error/diagnostic data, limited PII | EU data residency (Sentry EU) (deployment config, not verified here) | Intra-EEA; SCCs if US access |
🔴 Removed: Amazon Web Services — SES. An earlier internal version listed SES as a "fallback" email path. No SES integration exists (measured 2026-08-09: the only
IEmailSenderimplementations areAcsEmailSender(production) andLoggingEmailSender(dev/test); no AWS SDK package, client or configuration section is present). Listing a subprocessor that receives no data misdescribes the processing chain in the opposite direction from the usual error, and it would have been carried into SCC Annex III. If an SES fallback is later built, it re-enters this list under the §7 change-notice procedure.
Search (Typesense). Product/content search uses Typesense (measured:
Ciqra.Api.csproj:73;TypesenseSearchIndexer.cs), with a no-op indexer fallback when it is not configured, in which case the storefront falls back to database search (Program.cs:669-674). CIQRA's determination: an earlier internal version asserted Typesense "runs self-hosted on CIQRA's Azure infrastructure in Germany and is an internal component, not a separate subprocessor". Whether the deployed instance is self-hosted on CIQRA's own Azure infrastructure or a managed third-party service is a deployment fact this reconciliation could not measure. If it is ever run as a managed third-party service, it becomes a subprocessor and must be listed. This must be confirmed against the production deployment before the list is published.
3. Payments (independent controller/processor)
| # | Party | Purpose | Personal data | Location | Basis |
|---|---|---|---|---|---|
| 6 | Stripe (Stripe Payments Europe, Ltd. — Ireland; Stripe, Inc. — US) | Payment processing, Stripe Connect, KYC/KYB, fraud, payouts | Payment/transaction data, KYC/beneficial-owner data — no raw PAN reaches CIQRA (see §3.1) | EU + US | Stripe's own terms + SCCs for US flows; Stripe is largely an independent controller/processor |
3.1 The no-raw-PAN statement is measured, and it has a named condition (2026-08-09). Card fields on the storefront checkout are Stripe Elements iframes, not CIQRA inputs — the number, expiry and CVC are rendered as data-stripe-field mount points (ciqra-saas/src/Ciqra.Api/Storefront/Themes/default/checkout-payment.liquid:99,110,117). The platform defines a raw-PAN seam, IRawCardPaymentProvider / RawCardPaymentRequest, explicitly labelled SAQ D (Ciqra.Modules.Payment/PaymentAbstractions.cs:103-119) — and nothing implements it: grep -rn 'IRawCardPaymentProvider' src/ tests/ returns only the declaration and one doc-comment cross-reference. The local acquirers (İyzico, PayTR, bank virtual-POS) all route through INativePaymentProvider : IHostedPaymentProvider (INativePaymentProvider.cs:48), i.e. the hosted/3DS-redirect path, with BankVposSessionStore acting as the 3DS hand-off (NativePaymentsServiceCollectionExtensions.cs:53).
Condition, stated because it is one line of code away: the SAQ A posture holds only while
IRawCardPaymentProviderhas no implementation. Implementing it puts raw PAN into CIQRA's systems and moves the attestation to SAQ D. This should be a monitored invariant, not a fact recorded once.
4. AI subprocessors (feature-triggered)
🔴 All four are third-country transfers. There is no gateway terminating AI traffic inside the EEA — the earlier "self-hosted AI gateway on Azure" statement was incorrect and has been removed (measured 2026-08-09: AnthropicChatClientFactory.cs:30-40 hands the official Anthropic SDK a pooled HttpClient and calls the vendor API directly; AiServiceCollectionExtensions.cs:77,87 point BaseAddress at the Voyage and fal.ai vendor endpoints). See AI Terms §1.
| # | Party | Purpose | Personal data | Location | Basis |
|---|---|---|---|---|---|
| 7 | Anthropic (Anthropic Ireland, Ltd / Anthropic, PBC) | LLM inference — platform default for text (AiServiceCollectionExtensions.cs:92) | Minimised feature inputs/outputs | US | No-training (Commercial Terms) + SCCs — executed DPA/ZDR not verified, see §4.1 |
| 8 | OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | LLM inference; embeddings (:93, :95) | Minimised feature inputs/outputs | US | No-training by default (business/API terms) + SCCs — not verified, §4.1 |
| 9 | Voyage AI | Embeddings — default embedding provider (:94; https://api.voyageai.com/v1/embeddings, VoyageEmbeddingProvider.cs:11) | Text submitted for embedding | US | SCCs required — not verified, §4.1 |
| 10 | fal.ai | Image generation / editing (:96, :99, :102) | Submitted and generated images | US | SCCs required — not verified, §4.1 |
4.1 CIQRA's determination on rows 7–10. Rows 9 and 10 were absent from every earlier internal version of this list, which means they were also absent from DPA Annex IV / SCC Annex III. Embedding text and image content were therefore being sent to two undisclosed US recipients. Adding them here is the correction; it is not a statement that SCCs are in place. For all four rows, CIQRA has not verified within this workstream that an Art. 28 DPA and Art. 46 transfer mechanism are executed and on file. Treat rows 7–10 as disclosed-but-unpapered until each executed agreement is located.
4.2 Azure OpenAI (intended, not engaged). CIQRA has decided to migrate inference to Azure OpenAI (ciqra-openai-prod, germanywestcentral), which would make AI processing intra-EEA and retire rows 7–8. As at 2026-08-09 that provider is not engaged: the azure-openai identifier exists only as a constant with no client, no HTTP registration and no service registration (AiVocabulary.cs:35, :45). It is therefore deliberately not listed as a subprocessor — listing it would be the same error as the SES row. It enters this list under §7 when it is wired.
5. Consent-based & Merchant-opt-in recipients (not default subprocessors)
Process personal data only where enabled by the relevant Merchant/end-user; the Merchant is typically the controller.
| # | Party | Purpose | Trigger | Basis |
|---|---|---|---|---|
| 11 | Google (Ireland Ltd) — GA4 / Tag Manager / Google Ads; reCAPTCHA v3 | Analytics & advertising; bot protection | Cookie/ad consent. 🔴 reCAPTCHA: corrected 2026-08-10 — the earlier entry read "(reCAPTCHA: security)" and that is not a basis. Loading reCAPTCHA reads and writes the visitor's terminal equipment, which under ePrivacy Art. 5(3) (register 1.4) permits only consent or a statutory exemption — "security" is neither, and Art. 5(3) has no legitimate-interest gateway. See PA-0371; the ruling is in Cookie Policy §4.2. | Consent (Art. 5(3)) for the terminal-equipment access; Art. 6 separately for the processing; SCCs for the onward transfer. 🟢 Corrected 2026-08-10 — the server-side IP transfer has been removed. An earlier version of this row recorded that the siteverify call also sent the visitor's IP to Google server-side, independent of anything the browser did. Re-measured: the request body now carries secret and response only, and the remoteIp parameter is deleted from the call chain rather than left unread (CaptchaVerifiers.cs:14-36). 🔑 That closes the one channel a browser could never have shown. The script tag and the challenge remain, and they are what §4.2 of the Cookie Policy is about. |
| 12 | Meta Platforms (Ireland Ltd) — Pixel & Conversions API | Advertising measurement (incl. server-side) | Cookie/ad consent | Consent + SCCs; possible joint controllership (Fashion ID) |
| 13 | TikTok (Technology Ltd, Ireland) | Advertising measurement | Cookie/ad consent | Consent + SCCs |
| 14 | hCaptcha (Intuition Machines, Inc.) | Bot protection — accepted alongside reCAPTCHA and Cloudflare Turnstile (measured: Ciqra.Api/Cms/FormEndpoints.cs:40 accepts g-recaptcha-response, cf-turnstile-response, h-captcha-response) | Merchant selects the provider | SCCs (US entity) |
| 15 | Shipping carriers (DHL, UPS, FedEx, Yurtiçi Kargo, PTT) | Rate quotes, label creation, tracking | Merchant enables the carrier | Recipient/processor per carrier — contracting entity and basis not verified here |
| 16 | SMS providers (Netgsm, İletimerkezi) | Transactional SMS (measured: api.netgsm.com.tr, api.iletimerkezi.com in source) | Merchant enables SMS | Turkey — third country; transfer basis not established, see §5.1 |
| 17 | Marketplace channels (as connected by the Merchant) | Channel listing & order sync | Merchant opt-in connection | Per channel; transfer safeguards not yet assessed |
5.1 CIQRA's determination on rows 15–16. Carrier and SMS integrations were not represented in any previous version of this list, yet they receive recipient name, address and phone number — ordinary personal data of shoppers, not telemetry. The Turkish SMS providers in row 16 are recipients in a third country without an EU adequacy decision for transfers of this kind, and no transfer mechanism has been identified. These rows are added so the omission is visible; their transfer basis is an open item.
6. Professional & occasional recipients
Auditors, legal/financial advisers, and authorities — only where legally required or to establish/defend legal claims; and an acquirer/successor in a corporate transaction (subject to confidentiality). Not ongoing subprocessors.
7. Change management
- CIQRA notifies Controllers of intended additions or replacements ≥30 days in advance (subprocessor page + email/subscription), with a reasonable-grounds objection right (DPA §5.2) and an emergency-addition carve-out for security/continuity (DPA §5.3).
- The Azure OpenAI migration (§4.2) is a subprocessor change and triggers this procedure.
8. Before this list is published
CIQRA's determination: the following are open, and this list must not be presented as a completed Annex III until they are closed. They are listed here rather than left as flags so that the gaps are countable.
- Confirm each entity's exact legal name and contracting entity — carried forward from an earlier internal version, not verified here.
- Locate the executed DPA + Art. 46 transfer mechanism for rows 7–10 (AI), and establish one for row 16 (TR SMS).
- Confirm the hosting model for Typesense (§2 note) — self-hosted or managed third party.
- Confirm the deployment region claims for Grafana Cloud and Sentry (rows 4–5); these are configuration, not code.
- Re-run this reconciliation against the production stack on launch day, not against the source tree — a provider can be configured in production without appearing in source, and this measurement would not see it.
Composition of this document: 8 measured facts · 5 declared positions · 3 corrections to earlier assertions.
End of Subprocessor List . Referenced by: Privacy Policy · DPA (Annex IV / SCC Annex III) · AI Terms.