What is a sub-processor?
A sub-processor is a company that a processor engages to carry out part of the processing of personal data on a controller's behalf, such as hosting, email delivery or error reporting. The controller must authorise it in advance.
Written by Ugo Balducci. Last updated
What a sub-processor means
Data protection law separates three roles. The controller decides why and how personal data is processed. The processor handles it on the controller’s instructions. A sub-processor is any further company the processor brings in to do part of that work: the datacentre operator, the email service, the monitoring tool.
Both Swiss and EU law control this chain. Under article 9 of the revised FADP, a processor may hand processing to a third party only with the controller’s prior authorisation. Under article 28 of the GDPR, the authorisation can be specific or general; with a general authorisation the processor must inform the controller of changes and give it the chance to object. The processor stays responsible for the sub-processors it uses.
Why it matters when choosing where software runs
A provider’s sub-processor list tells you more about where your data goes than its marketing does. Each entry has a country, a legal owner and a role. Together they decide your data residency, your exposure to foreign laws such as the CLOUD Act, and whether a transfer outside Switzerland and the EU needs standard contractual clauses.
When you review a list, ask which entries touch your application data and which only see metadata or network traffic, which are optional, and how much notice you get before a change.
How Pilae handles it
Pilae discloses its sub-processors to you in the standard DPA that comes with every plan, each with its role and where it processes data. Optional services, such as AI features, are used only if you enable them.
Where your application data sits depends on your deployment. On your premises it stays on your servers. In Pilae Cloud it sits on dedicated machines in ISO 27001-certified datacentres in the country you choose. Changes are notified in advance, with a right to object before they take effect, and services you exclude are written into your contract. Questions go to privacy@pilae.com. Procurement teams will find the rest of the paperwork on the procurement page.