From 795785653d81a161476fb702aead41e140b508e0 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 21:03:21 +0200 Subject: [PATCH] chore: sync DPA sub-processors from trust center (#22403) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Automated weekly sync of `subprocessors.json` from Twenty's Trust Center (OneLeet). This keeps the DPA's Annex C (the SCC Annex III list of Sub-Processors) in lockstep with the canonical list at https://trust.twenty.com — the Trust Center is the single source of truth; this file is generated from it. **Please review before merging** — confirm the added/removed Sub-Processors are expected, and that customers were notified per Section 6.2 where required. Review in cubic Co-authored-by: FelixMalfait <6399865+FelixMalfait@users.noreply.github.com> --- .../dpa/constants/subprocessors.json | 38 +++++++++++-------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/packages/twenty-server/src/engine/core-modules/dpa/constants/subprocessors.json b/packages/twenty-server/src/engine/core-modules/dpa/constants/subprocessors.json index a1a3412fed..3146993fc3 100644 --- a/packages/twenty-server/src/engine/core-modules/dpa/constants/subprocessors.json +++ b/packages/twenty-server/src/engine/core-modules/dpa/constants/subprocessors.json @@ -3,16 +3,16 @@ { "name": "Amazon Web Services", "services": [ - "Amazon Web Services stores a wide range of customer-owned data hosted on its cloud infrastructure. This includes application databases, file objects, backups, logs and analytics datasets, virtual machine images, and other compute and storage resources used by customers to run their services. Such data may contain user account information, CRM records, documents and files, email and collaboration data, and associated metadata like configuration settings, network logs, access logs, IP addresses and timestamps. The platform also stores company-owned data such as customer account details, billing and subscription information, usage metrics, service configuration data, and internal logs needed to operate, monitor, and secure the AWS environment." + "Amazon Web Services (AWS) provides the cloud infrastructure on which the Twenty CRM runs — compute, managed databases, object storage, and encrypted backups. AWS is Twenty's primary hosting provider." ], - "processingLocations": ["US", "DE", "FR"], + "processingLocations": ["DE"], "processesPii": true, "vendorUrl": "https://aws.amazon.com" }, { "name": "Anthropic", "services": [ - "Anthropic stores customer-owned data such as prompts and conversation transcripts from interactions with its AI models, including the text of questions, instructions, responses, and user-provided context. This may include uploaded documents, code snippets, and other file attachments used in those interactions, as well as metadata like timestamps, session identifiers, IP addresses, and user identifiers. The platform also stores company-owned data like user account details, API keys, billing and subscription records, usage analytics, configuration settings, and internal logs needed to operate, monitor, and secure the service." + "Anthropic provides large language models that power Twenty's optional AI features, such as drafting, summarization, and data enrichment." ], "processingLocations": ["US"], "processesPii": true, @@ -21,45 +21,53 @@ { "name": "ClickHouse", "services": [ - "ClickHouse stores customer-owned data such as analytics event data, log data, and other less-structured information ingested by clients (the structured part is in RDS). It also stores company-owned data like configuration metadata, usage metrics, user account details, and internal logs generated by its services." + "ClickHouse provides the analytical database Twenty uses to store audit logs and power in-product analytics and reporting." ], - "processingLocations": ["US"], + "processingLocations": ["DE"], "processesPii": true, "vendorUrl": "https://clickhouse.com/" }, { "name": "Cloudflare", "services": [ - "Cloudflare stores network traffic logs, DNS records, cached content, IP addresses, HTTP request and response headers, and Web Application Firewall (WAF) logs generated by its content delivery and security services. It also stores analytics dashboards with visitor statistics, access logs, performance metrics, threat patterns and detections, and related metadata such as timestamps, geolocation, and user agent information. Additionally, Cloudflare retains customer account details, billing and subscription records, usage analytics, configuration settings, and security logs required to operate and secure the service." + "Cloudflare provides Twenty's content delivery network, DNS, and web application firewall, securing and accelerating traffic to the service. It does not retain Customer Personal Data on a long-term basis." ], - "processingLocations": ["US"], - "processesPii": true, + "processingLocations": ["US", "EU"], + "processesPii": false, "vendorUrl": "https://www.cloudflare.com" }, { "name": "Google Cloud Platform", "services": [ - "Google Cloud Platform stores customer-owned data including Google Maps search queries or login activities of users who logged in through Google. It also stores company-owned data such as user account and identity information, billing and payment details, project and organization configurations, usage analytics, service and audit logs, and internal operational metrics." + "Google Cloud Platform provides specific Google services that Twenty integrates, such as Maps and Google sign-in." ], - "processingLocations": ["US"], + "processingLocations": ["US", "EU"], "processesPii": true, "vendorUrl": "https://cloud.google.com" }, + { + "name": "Mistral", + "services": [ + "Mistral AI provides large language models that power Twenty's optional AI features. The AI provider used depends on the model configured for the workspace." + ], + "processingLocations": [], + "processesPii": false + }, { "name": "OpenAI", "services": [ - "OpenAI stores customer-owned data such as prompts, chat transcripts, code snippets, uploaded documents, and other inputs provided by users along with generated outputs. This includes metadata such as timestamps, session identifiers, IP addresses, and user interaction context. OpenAI also stores company-owned data including user account details, API keys, billing and subscription information, usage analytics, model training datasets, configuration settings, and internal system logs for operational and security purposes." + "OpenAI provides large language models that power Twenty's optional AI features. The AI provider used depends on the model configured for the workspace." ], - "processingLocations": ["US"], - "processesPii": true, + "processingLocations": [], + "processesPii": false, "vendorUrl": "https://openai.com" }, { "name": "Sentry", "services": [ - "Sentry stores customer-owned data such as error events, exception stack traces, crash dumps, performance metrics, logs, user context information, breadcrumbs, HTTP requests and responses, release identifiers, build artifacts, and associated metadata (timestamps, device information, operating system, browser data, IP addresses, user identifiers, email addresses or usernames). This data may include personally identifiable information if present in error reports or user context. Additionally, Sentry stores company-owned data such as organization and project settings, team member contact information, API keys, usage analytics, billing and subscription records, configuration settings, integration tokens, and internal logs needed to operate and secure the service." + "Sentry provides application error and performance monitoring, helping Twenty detect, diagnose, and resolve issues in the service." ], - "processingLocations": ["US"], + "processingLocations": ["US", "EU"], "processesPii": true, "vendorUrl": "https://sentry.io" }