Sub-processors
Last updated: 29 October 2026
Legal documents: Sub-processors
In short
- Customer Data is stored in Switzerland (Zurich). The application runs in Germany, where we also keep a daily backup copy of uploaded files.
- AI features run in the EU with zero data retention. Customer Data never trains AI models. Your organisation can have them switched off at any time.
- Email delivery uses a provider based in the United States, and SMS sign-in codes are sent from the United States. We rely on recognised transfer safeguards for both.
- Any customer can get the named list free of charge from info@softwarevision.ch. We announce new sub-processors at least 14 days in advance, and you can object.
1.Konsaro platform — sub-processors
When you use Konsaro, your organisation (the Customer) is the controller of Customer Data. Software Vision AG processes it on your behalf as processor, under our Data Processing Agreement and the Terms and Conditions. The providers below help us deliver Konsaro. They are our sub-processors.
| Service | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Data storage | Database, file storage and sign-in | All Customer Data, user accounts, phone numbers for two-factor sign-in, sign-in and audit logs | Switzerland (Zurich) | Switzerland — no transfer |
| Application hosting | Running the web application and scanning uploaded files for malware | Customer Data while the application processes it, server logs with IP addresses and browser details | Germany | Germany — adequacy (EU/EEA) |
| Backup copy of files | A daily backup copy of all uploaded files, kept on the application servers | Uploaded documents and the personal data they contain | Germany | Germany — adequacy (EU/EEA) |
| AI processing | AI features such as rephrasing and translating texts and suggesting tasks. Only used while AI features are switched on. Zero data retention. Never used to train AI models | Content that users submit to AI features | EU | EU/EEA — adequacy |
| Error monitoring | Detecting and fixing technical errors | Technical error reports: error message, page address, browser and operating system. We configure it not to attach cookies or IP addresses, but a report can occasionally contain an identifier | Germany | Germany — adequacy (EU/EEA) |
| Email delivery | System emails such as invitations to Konsaro, sign-in links and meeting notifications | Name, email address, subject and text of the message, including meeting and agenda titles. No documents or attachments | Ireland (EU); provider based in the United States | Ireland — adequacy (EU/EEA). United States — Standard Contractual Clauses with the amendments required by Swiss law, or the Data Privacy Framework where the provider is certified |
| SMS delivery | Sending one-time sign-in codes by SMS | Phone number and the code | United States | United States — Standard Contractual Clauses with the amendments required by Swiss law, or the Data Privacy Framework where the provider is certified |
AI features are switched on by default where your plan includes them. Organisation administrators can ask us at any time to switch them off for the whole organisation. While they are off, no content is sent for AI processing.
Some providers that store or process data in Switzerland or the EU belong to groups headquartered in the United States. They may access data from there for support or operations. We require any such access to be covered by the same safeguards as a transfer to the United States.
We require each sub-processor to sign a written data processing agreement. Its data protection obligations must be no less protective than those in our Data Processing Agreement. We remain responsible to the Customer for the work of our sub-processors.
Support requests that users send from the app go to a support system that Software Vision AG runs itself; it is not a third-party provider. If your organisation signs in with its own Microsoft account, Microsoft acts under your organisation's own agreement with Microsoft and is not our sub-processor.
2.The named list
This page lists the categories of sub-processors and their countries. We also keep a named list with each provider's name, service and location. Every customer can get it, including customers on a self-service plan or a trial.
- Email info@softwarevision.ch and ask for the named list of sub-processors.
- We send it free of charge within 10 business days.
- We also send it to the first organisation administrator when we set up a new organisation.
3.Changes to sub-processors
We tell customers at least 14 days before a new sub-processor starts processing Customer Data. We send the notice by email to the organisation's administrators and to the contact named in the contract. We also update this page and its date. In an emergency, such as a provider failure or a security risk, we may switch to a replacement at once and tell customers without delay; they can still object. Providers that never process Customer Data, such as our internal tools, are not sub-processors and are not announced.
The Customer may object to a new sub-processor on reasonable data protection grounds, as set out in the Data Processing Agreement. If we cannot find a solution together, the Customer may cancel the affected service.
4.This website — our processors
For the website konsaro.com, Software Vision AG is the controller. The providers below process data on our behalf. They are our processors, not sub-processors. No Customer Data from the Konsaro platform is processed on the website. Details are in our Privacy Policy.
| Service | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Website hosting and analytics | Hosting konsaro.com, storing form submissions, and website analytics on our own server (only with your consent) | Server logs with IP addresses, form submissions, analytics events with a random browser identifier | Germany | Germany — adequacy (EU/EEA) |
| Email delivery | Sending form submissions to us and download links to you | Name, email address, company, role, phone number if given, message | Ireland (EU); provider based in the United States | Ireland — adequacy (EU/EEA). United States — Standard Contractual Clauses with the amendments required by Swiss law, or the Data Privacy Framework where the provider is certified |
| Video conferencing | Creating the online meeting and calendar invitation when you book a demo | Name, email address, company, message, meeting time | Provider based in the United States; data may be processed there | United States — Standard Contractual Clauses with the amendments required by Swiss law, or the Data Privacy Framework where the provider is certified |
Demo bookings, personal invitation pages and consented analytics events are also handled by our own sales system, which Software Vision AG runs itself. Its hosting may take place in the United States. To prepare personal invitations, we also use providers of business contact data and AI-based research tools, which may process data in the United States. For these transfers, the same safeguards apply as for the United States in the table above. Details are in sections 7 and 13 of our Privacy Policy.
5.Contact
Questions about sub-processors: info@softwarevision.ch.
More information: Trust Center → Sub-processors