Sub-processors
Sub-processors
This page lists the sub-processors engaged by Oncode S.r.l. to provide the Onwork SaaS platform, in compliance with GDPR Article 28. Customers are notified of changes at least 30 days in advance.
- Version
- v2026-04
- Effective
- 2026-04-25
Current sub-processors
| Vendor | Purpose | Country | Transfer mechanism | Start date |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, compute, S3 storage | Ireland (eu-west-1) | AWS DPA + EU SCCs | 2024-01 |
| MongoDB Atlas | Managed database (where used) | EU | MongoDB DPA + EU SCCs | 2024-01 |
| HashiCorp Vault | Secret management (self-hosted) | EU (Oncode infrastructure) | N/A (no third-party transfer) | 2024-01 |
| Iubenda | Cookie & privacy compliance, consent management | Italy | Iubenda DPA | 2024-01 |
| Brevo (formerly Sendinblue) | Transactional email and marketing | France (EU) | Brevo DPA | 2024-01 |
| Stripe | Payment processing (where used) | Ireland (EU HQ) | Stripe DPA + EU SCCs | 2024-06 |
| Grafana Labs (Loki, Tempo, Pyroscope) | Observability, logs, traces, profiling | EU (Oncode self-hosted) | N/A | 2024-01 |
| OpenAI / Anthropic / Groq (AI Assistant) | Large Language Model inference for AI features (when enabled) | USA | EU SCCs + Data Privacy Framework (DPF) where applicable | 2025-01 |
| Better Stack / Instatus | Public status page (status.onwork.oncode.it) | EU | Vendor DPA | 2026-04 |
Notification of changes
We will notify Customers of any intended addition or replacement of sub-processors at least 30 days in advance by email and via the in-app notification system. Customers may object to a new sub-processor for legitimate reasons; if the objection cannot be resolved, the Customer may terminate the Agreement effective at the end of the current billing period.
International transfers
Most sub-processors operate within the EU. For US-based providers, Onwork relies on Standard Contractual Clauses (Decision EU 2021/914) and the EU-US Data Privacy Framework (DPF) where the vendor is certified. Transfer Impact Assessments are conducted where relevant.
Archive
Versioned snapshots of this page are available as PDF in /public/docs/. Customers can request prior versions via [email protected].