Last updated: Sept. 16, 2026. This page lists the sub-processors and third-party service providers engaged by Carbonfact (operated by Kanso SAS). It is the canonical, static list referenced by our Data Processing Agreement (DPA) and published at carbonfact.com/security.

Carbonfact reviews all sub-processors through a risk-based due diligence process, including security assessments prior to engagement. All sub-processors that process personal data are bound by GDPR-compliant Data Processing Agreements imposing equivalent Technical and Organisational Measures (TOMs) and confidentiality obligations. Carbonfact provides at least 30 calendar days**,** prior written notice of any intended addition or replacement of a sub-processor.

Subscribe here to receive updates when we add or change a sub-processor for Carbonfact Platform & Carbonfact for Suppliers.

Carbonfact Platform & Carbonfact for Suppliers

Core Sub-Processors

These sub-processors process customer data and personal data on behalf of Carbonfact, where Carbonfact acts as a Data Processor for its customers.

Sub-processor	Location	Purpose
Auth0 (Okta, Inc.)	Company: USA
Processing: EU	Identity & access management (login, signup, session management)	SCCs
Cloudflare, Inc.	Company: USA
Processing: USA/Global	Security (WAF, DDoS mitigation), CDN, TLS termination, bot protection (Turnstile)	SCCs
Couchdrop Limited	Company: New Zealand
Processing: USA	SFTP gateway for bulk data import/export (optional — only if SFTP integration is used)	SCCs
GitHub (GitHub B.V. / GitHub, Inc.)	Company: Netherlands
Processing: USA	CI/CD pipeline for data processing workflows and database migrations	SCCs
Google Cloud Platform (Google Cloud France)	Company: France
Processing: EU (multiple regions)	Primary cloud Processing and data persistence (Frankfurt/EU region)	Within EEA
HubSpot, Inc.	Company: USA
Processing: USA	CRM, sales operations and customer relationship management	SCCs
Jimo	Company: France
Processing: EU	In-app announcements, user feedback and feature communication	Within EEA
PostHog, Inc.	Company: USA
Processing: EU	Product usage analytics and UX insights	SCCs
Postmark (ActiveCampaign, LLC)	Company: USA
Processing: USA	Transactional email delivery (password resets, notifications)	SCCs
Sentry, Inc.	Company: USA
Processing: EU	Application error monitoring and incident debugging	SCCs
Vercel Inc.	Company: USA
Processing: USA/Global	Frontend web application Processing and static asset delivery	SCCs

Auth0

Purpose: Enables secure login, signup, and session management for customer users and internal admins.
Description of Data Processing: Identity and access management service hosted in EU; processes user identity data (first, last names, email address, role/position), credentials, tokens, and authentication metadata.
Processed Personal Data: Email addresses; Names (first and last); Password hashes; User IDs; IP addresses; Login timestamps and session data; Authentication tokens and metadata.
Processing Location: EU — Transfer mechanism: SCCs
Company: Auth0, Inc.
Headquarter Address: 10800 North East 8th Street Suite 600, Bellevue, WA 98004, United States
Contact: [email protected] (see https://www.okta.com/legal/privacy-policy/ for more details)

Cloudflare

Purpose: Provides security services (incl. WAF and DDoS mitigation), performance optimization, and TLS termination for all customer-facing web services.
Description of Data Processing: Global content-delivery and security network operating from edge data centers worldwide; processes IP and request metadata for caching and protection.
Processed Personal Data: IP addresses; User agent strings; HTTP request metadata (headers, cookies); Request timestamps; Geographic location data (derived from IP); TLS fingerprint
Processing Location: USA / Global — Transfer mechanism: SCCs