Sub-processors.

Last updated: 17 August 2026.

When you use Lab33 OS, Lab33 Ltd acts as a processor of the personal data you put into the platform, and you remain the controller of it. To run the platform we rely on a small number of carefully selected third parties. Under Article 28 of the GDPR these are our sub-processors, and this page is the public register of them.

Every sub-processor is bound by a written contract imposing data-protection obligations no less protective than those in our own Data Processing Agreement, and Lab33 remains fully liable to you for their performance. We keep the list short on purpose.

Qualified Electronic Signatures (QES) in Contract33 are provided through Swisscom Trust Services, a qualified trust service provider under the eIDAS Regulation. As a qualified trust service provider, Swisscom acts as an independent data controller for signer identity verification and the issuance of qualified certificates, under its own statutory obligations, and is therefore not a sub-processor. When a signature is requested, Swisscom receives a cryptographic hash of the document (never the document itself), the contract reference, and the signer's mobile number where previously verified. Signer identity and signature evidence data is processed only within the EEA and Switzerland, which is covered by a European Commission adequacy decision (Article 45 GDPR), and is retained under the statutory retention periods that apply to qualified trust service providers. This processing is governed by Swisscom's own terms and privacy statements.

Customer data is hosted and processed in data centres inside the European Union by default. The primary region is Paris, France, across three availability zones, with encrypted geo-redundant backups and disaster-recovery replicas held in Gravelines and Strasbourg. The infrastructure is contracted through OVH Hosting Ltd, an Irish company, and the data centres are operated by the OVH group in France.

We do not transfer customer personal data outside the EU or EEA unless the transfer is to a country covered by an adequacy decision under Article 45 of the GDPR, is protected by appropriate safeguards under Article 46 (including the European Commission’s Standard Contractual Clauses, supplemented where a transfer impact assessment requires it), or is otherwise permitted by data protection law.

One category of transfer is worth calling out. Where you use our AI-powered capabilities, the content you submit to them is processed by our AI sub-processor in the United States, under our data processing agreement with that provider and the EU Standard Contractual Clauses (Article 46 safeguards).

Before we add or replace a sub-processor, we give customers at least thirty days’ written notice, by email to your primary contact and by updating this register.

Within that period you may object in writing on reasonable, documented data-protection grounds. We will then work with you in good faith to find a solution, which may mean proposing an alternative provider or additional safeguards. If no solution is found, you may terminate the affected services under the terms of your agreement, and where your objection is sustained and no reasonable alternative exists, prepaid fees for the unused remainder of the subscription year are refunded pro rata.

This register covers only the third parties that process customer personal data on your behalf under Article 28 of the GDPR. Providers that touch only data Lab33 processes as an independent controller, such as payment processing for our own invoices, our own accounting, and our source-code hosting, are not sub-processors of your platform data. They are Lab33's own processors, they hold data-protection agreements with us in that capacity, and they are disclosed in our privacy policy rather than here.

Account data belonging to your authorised users, which we hold for platform administration, authentication and security, along with billing and subscription data, is processed by Lab33 as an independent controller and is covered by our privacy policy rather than this register.