Trust & security · Last updated 24 October 2026

Subprocessors.

Who processes customer data for Proofbacked, what for, and where.

In use today

Scaleway SAS
Hosting: application, database, file storage, logs and e-mail.
Paris region, France.

Berget AI AB
AI inference for drafts, extraction and proposals. The only AI provider the platform calls.
Sweden.

Other recipients

FreeTSA
A trusted timestamp on every seal. It receives a hash, no content and no personal data.

OSV.dev
Checks an uploaded software bill of materials against known vulnerabilities. It receives package names and versions, not personal data.
United States.

Off until an organisation turns them on

Some features use another provider only when an organisation switches them on: e-ID (Idura, Denmark), company and sanctions checks (TIC and Bolagsverket, Sweden), a fallback search for a supplier's own security pages (Exa, United States; it receives the supplier's name and domain, never yours), and notifications to Slack, Microsoft Teams or mobile devices (United States). None is on today.

Changes

Customers are told before we add or replace a subprocessor, under their data processing agreement. Draft agreements in English (DPA) and Swedish (PUB-avtal) are available from hello@proofbacked.com.