Annex IV · Exhibit D · Data Processing Addendum
Sub-processor Register
Echory GmbH ("echory") engages the sub-processors listed below to provide the echory real-time AI decision support platform, under written terms governing security and confidentiality.
This register is maintained continuously and is referenced by the Data Processing Addendum (DPA). Changes are notified to controllers in accordance with the DPA, which governs the notice period and the customer's right to object. Objections and questions: security@echoryflow.com
This register is maintained continuously and is referenced by the Data Processing Addendum (DPA). Changes are notified to controllers in accordance with the DPA, which governs the notice period and the customer's right to object. Objections and questions: security@echoryflow.com
1
Current Sub-processors
This register covers sub-processors engaged in delivering the echory platform, where echory acts as processor on behalf of its customers. Service providers used on our public website — analytics, campaign measurement and payment processing, where echory acts as controller in its own right — are listed separately in our Privacy Policy and Cookie Policy. No customer content from the platform is transmitted to any of those providers.
| Sub-processor | Role | Processing location | Transfer basis | Certifications |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure: compute, database, object storage, backups, transactional email | Germany (EU, Frankfurt), eu-central-1 | EU, no transfer | ISO 27001, SOC 1/2/3, ISO 27017/27018 |
| Deepgram, Inc. | Real-time speech-to-text transcription (ASR) via EU endpoint. Receives the audio stream, returns the transcript. Audio is not retained beyond the active session | European Union (EEA) | EU, no transfer | SOC 2 Type II |
| OpenAI Ireland Limited processing by OpenAI, LLC |
Large language model inference for meeting analysis: state analysis, next best action, objective coverage, executive summary and meeting review. Indexing of customer-uploaded files for retrieval | USA | SCC Module 3 under OpenAI’s Data Processing Addendum |
SOC 2 Type II, ISO 27001 |
| INSTRAT Technology ApS | Software development, deployment, maintenance and technical support. Scoped, task-bound and logged access to production environments | Denmark (EU), legal entity Bangladesh, remote developer access |
EU, no transfer (Denmark) SCC Module 3 (remote access from Bangladesh) |
Contractual obligations |
| IT operations contractor engaged by INSTRAT Technology ApS | General IT services and IT operations support for the echory platform. Scoped, task-bound and logged access; no standing production data access | Bangladesh | SCC Module 3 Processor to Processor |
Contractual obligations |
No model training on customer data. For language model inference this follows from the provider’s standard API terms, in effect since 1 March 2023, under which data sent to the API is not used for training. For speech-to-text, model training is disabled at account level for echory’s account.
2
Transfers Outside the EEA
The following transfers are covered by Standard Contractual Clauses (EU Commission Decision 2021/914 of 4 June 2021), supplemented by the technical measures set out in the Technical and Organisational Measures:
| Transfer | Destination | SCC Module | Data transferred |
|---|---|---|---|
| echory → OpenAI Ireland Limited | USA | Module 3 (Processor to Processor) | Transcript text, meeting context, objectives, files uploaded by the customer |
| INSTRAT Technology ApS → echory infrastructure | Bangladesh (remote access) | Module 3 (Processor to Processor) | Scoped and logged remote access to echory infrastructure for development, maintenance and support |
| INSTRAT Technology ApS → IT operations contractor | Bangladesh | Module 3 (Processor to Processor) | Scoped and logged remote access to echory infrastructure for IT operations support |
Only data strictly necessary for the specific processing task is transmitted to a third-country recipient. Transfer Impact Assessments supplementing the Standard Contractual Clauses are maintained and available to customers on request.
3
Change History
| Date | Change |
|---|---|
| August 2026 | Register published as a standalone page. Previously maintained as §6 of the Technical and Organisational Measures (v3.3). The IT operations contractor engaged by INSTRAT Technology ApS is now listed separately; this reflects an existing arrangement disclosed in INSTRAT’s vendor data processing agreement rather than a new engagement. |
| 12 June 2026 | Deepgram, Inc. migrated to the EU endpoint. Processing location changed from USA to the European Union; the transfer to the USA and its Standard Contractual Clauses no longer apply to this processing. |
| May 2026 | Transfer basis for OpenAI, LLC and INSTRAT Technology ApS corrected to SCC Module 3 (Processor to Processor). |