Last updated: July 28, 2026. This page lists the sub-processors and third-party service providers engaged by Carbonfact (operated by Kanso SAS). It is the canonical, static list referenced by our Data Processing Agreement (DPA) and published at carbonfact.com/security.

Carbonfact reviews all sub-processors through a risk-based due diligence process, including security assessments prior to engagement. All sub-processors that process personal data are bound by GDPR-compliant Data Processing Agreements imposing equivalent Technical and Organisational Measures (TOMs) and confidentiality obligations. Carbonfact provides at least 10 business days or 15 calendar days, whichever is longer, prior written notice of any intended addition or replacement of a sub-processor.

Subscribe here to receive updates when we add or change a sub-processor for Carbonfact Platform & Carbonfact for Suppliers.

Carbonfact Platform & Carbonfact for Suppliers

Core Sub-Processors

These sub-processors process customer data and personal data on behalf of Carbonfact, where Carbonfact acts as a Data Processor for its customers.

Sub-processor	Location	Purpose
Auth0 (Okta, Inc.)	Company: USA
Processing: USA	Identity & access management (login, signup, session management)	SCCs
Cloudflare, Inc.	Company: USA
Processing: USA/Global	Security (WAF, DDoS mitigation), CDN, TLS termination	SCCs
Couchdrop Limited	Company: New Zealand
Processing: USA	SFTP gateway for bulk data import/export (optional — only if SFTP integration is used)	SCCs
GitHub (GitHub B.V. / GitHub, Inc.)	Company: Netherlands
Processing: USA	CI/CD pipeline for data processing workflows and database migrations	SCCs
Google Cloud Platform (Google Cloud France)	Company: France
Processing: EU (multiple regions)	Primary cloud Processing and data persistence (Frankfurt/EU region)	Within EEA
HubSpot, Inc.	Company: USA
Processing: USA	CRM, sales operations and customer relationship management	SCCs
Jimo	Company: France
Processing: EU	In-app announcements, user feedback and feature communication	Within EEA
PostHog, Inc.	Company: USA
Processing: EU	Product usage analytics and UX insights	SCCs
Postmark (ActiveCampaign, LLC)	Company: USA
Processing: USA	Transactional email delivery (password resets, notifications)	SCCs
Sentry, Inc.	Company: USA
Processing: EU	Application error monitoring and incident debugging	SCCs
Vercel Inc.	Company: USA
Processing: USA/Global	Frontend web application Processing and static asset delivery	SCCs

Auth0

Purpose: Enables secure login, signup, and session management for customer users and internal admins.
Description of Data Processing: Identity and access management service hosted in EU; processes user identity data (first, last names, email address, role/position), credentials, tokens, and authentication metadata.
Processed Personal Data: Email addresses; Names (first and last); Password hashes; User IDs; IP addresses; Login timestamps and session data; Authentication tokens and metadata.
Processing Location: USA — Transfer mechanism: SCCs
Company: Auth0, Inc.
Headquarter Address: 10800 North East 8th Street Suite 600, Bellevue, WA 98004, United States
Contact: [email protected] (see https://www.okta.com/legal/privacy-policy/ for more details)

Cloudflare

Purpose: Provides security services (incl. WAF and DDoS mitigation), performance optimization, and TLS termination for all customer-facing web services.
Description of Data Processing: Global content-delivery and security network operating from edge data centers worldwide; processes IP and request metadata for caching and protection.
Processed Personal Data: IP addresses; User agent strings; HTTP request metadata (headers, cookies); Request timestamps; Geographic location data (derived from IP).
Processing Location: USA / Global — Transfer mechanism: SCCs