Last updated: Nov. 13, 2026. — In effect from: Dec. 9, 2026.

Current version in effect: Nov. 3, 2026.

This page lists the sub-processors and third-party service providers engaged by Carbonfact (operated by Kanso SAS). It is the canonical, static list referenced by our Data Processing Agreement (DPA) and published at carbonfact.com/security.

</aside>

Carbonfact reviews all sub-processors through a risk-based due diligence process, including security assessments prior to engagement. All sub-processors that process personal data are bound by GDPR-compliant Data Processing Agreements imposing equivalent Technical and Organisational Measures (TOMs) and confidentiality obligations. Carbonfact provides at least 30 calendar days**,** prior written notice of any intended addition or replacement of a sub-processor.

Subscribe here to receive updates when we add or change a sub-processor for Carbonfact Platform & Carbonfact for Suppliers.

Carbonfact Platform & Carbonfact for Suppliers

Core Sub-Processors

These sub-processors process customer data and personal data on behalf of Carbonfact, where Carbonfact acts as a Data Processor for its customers.

Auth0

Purpose: Enables secure login, signup, and session management for customer users and internal admins.
Description of Data Processing: Identity and access management service hosted in EU; processes user identity data (first, last names, email address, role/position), credentials, tokens, and authentication metadata.
Processed Personal Data: Email addresses; Names (first and last); Password hashes; User IDs; IP addresses; Login timestamps and session data; Authentication tokens and metadata.
Processing Location: EU — Transfer mechanism: SCCs
Company: Auth0, Inc. Parent company: Okta, Inc.
Headquarter Address: 10800 North East 8th Street Suite 600, Bellevue, WA 98004, United States
Contact: [email protected] (see https://www.okta.com/legal/privacy-policy/ for more details)

Cloudflare

Purpose: Provides security services (incl. WAF and DDoS mitigation), performance optimization, TLS termination for all customer-facing web services, and bot protection (Turnstile).
Description of Data Processing: Global content-delivery and security network operating from edge data centers worldwide; processes IP and request metadata for caching and protection.
Processed Personal Data: IP addresses; User agent strings; HTTP request metadata (headers, cookies); Request timestamps; Geographic location data (derived from IP); TLS fingerprint
Processing Location: USA / Global — Transfer mechanism: SCCs
Company: Cloudflare, Inc.