Sub-processors
What this list is
Sandstone Systems F.Z.E uses the following providers to run Trade Show Companion. Each one processes customer data only for the purpose stated here and under a contract with us. This list is the current version of the sub-processor annex referenced in the Data Processing Agreement and in section 5 of the Privacy Policy.
Infrastructure and delivery
| Provider | Purpose | Location |
|---|---|---|
| Contabo GmbH | Hosting of the application, databases, file storage and encrypted backups. | Germany, European Union |
| Cloudflare, Inc. | Reverse proxy, TLS termination, firewall and bot protection for all traffic to the app, the API and live updates. Also DNS, delivery of the marketing website, the public status page, and anonymous, cookieless usage statistics for the marketing website. | Global network, United States |
| Resend, Inc. | Transactional email: login links and codes, notifications, trial and account emails. | United States |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications to the mobile app. The title and text of a notification can contain names from your workspace, for example of a lead. Notifications to iPhones are passed on to Apple's push notification service. | United States |
AI processing
Requests to AI features (transcription of voice notes, structuring of notes and documents, company research, translations) are sent to the model providers below. Only the content needed to produce the requested output is sent. Our contracts with these providers exclude the use of customer content for training their models.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Transcription, structuring, text generation | United States |
| Anthropic, PBC | Structuring, assessment, text generation | United States |
| Perplexity AI, Inc. | Company and trade show research from public web sources | United States |
Other service providers (no access to your CRM data)
These providers help us run our own business relationship with you. They do not receive the content of your workspace (leads, contacts, companies, notes, files) and are therefore not sub-processors under the Data Processing Agreement.
| Provider | Purpose | Location |
|---|---|---|
| Stripe, Inc. and its affiliates | Payments and invoicing for our subscriptions. Card data is entered on Stripe's payment pages and processed by Stripe under its own privacy policy. We receive only the card brand, the last four digits and the expiry date. | United States and other countries |
Services you connect yourself
Google and Microsoft calendar accounts, and AI assistants such as Claude, ChatGPT, Microsoft Copilot or Google Gemini connected through MCP, are not sub-processors of ours. You connect them from your own account, after a consent dialog, and you can disconnect them at any time. Data exchanged with those services is governed by your agreement with the respective provider.
Changes to this list
We add a provider here before it processes customer data. Customers are notified in writing of new sub-processors at least 30 days in advance and may object as set out in the Data Processing Agreement. The date at the top of this page shows the last change.