Trust & Security
Our sub-processors, in full view
Fredo uses the following sub-processors to deliver its services. Questions can be directed to privacy@hifredo.com.
Service infrastructure
These sub-processors are part of the Fredo platform and process attendee data as a standard part of delivering the service.
| Sub-processor | Purpose | Data location | Transfer basis | DPA |
|---|---|---|---|---|
| Google Cloud EMEA Ltd. | Cloud hosting (servers, storage, backups) | EU (Belgium) | Not applicable (EU) | View DPA |
| DigitalOcean, LLC | Cloud hosting (servers, storage, backups). Also hosts our self-managed error tracking. | EU (Germany) | Not applicable (EU) | View DPA |
| Cloudflare, Inc. | Web traffic delivery and security (DNS, CDN, WAF, DDoS mitigation). Traffic is processed transiently in-memory at the nearest edge data center; logs and account metadata are stored in core data centers (EU/US). | Global edge; EU and US core | EU-US Data Privacy Framework | View DPA |
| Okta, Inc. (Auth0) | User registration, authentication, login event management, multi-factor authentication | EU (primary: Germany; secondary: Ireland) | Not applicable (EU) | View DPA |
| Hookdeck Technologies, Inc. | Webhook infrastructure, event routing, queuing and delivery monitoring | Canada and US | Canada adequacy decision (Art. 45 GDPR); EU-US Data Privacy Framework / SCCs for US sub-processors | View DPA |
| Scaleway | Transactional email to attendees | EU (primary: France; secondary: Italy) | Not applicable (EU) | View DPA |
Specialised support tools
These tools are not part of the standard processing of attendee data. They are used only in exceptional cases — when an issue with a customer's event (for example, attendees missing from an integration) requires our team to investigate specific records in order to resolve it.
| Sub-processor | Purpose | Data location | Transfer basis | DPA |
|---|---|---|---|---|
| Google Ireland Ltd. (Google Workspace) | Email and documents used when a customer sends us attendee details to resolve an issue with their event. Includes Gemini for Workspace. | EU/US (Google global infrastructure) | EU-US Data Privacy Framework; SCCs incorporated in Cloud Data Processing Addendum | View DPA |
| Zoho Corporation B.V. | Support ticketing (Zoho Desk), where a customer's support request may include attendee details needed to resolve an issue with their event | EU (Netherlands and Ireland) | Not applicable (EU) | View DPA |
| Slack Technologies (Salesforce, Inc.) | Internal coordination between support and engineering when investigating a specific issue with a customer's event | US | EU-US Data Privacy Framework; SCCs | View DPA |
| Anthropic, PBC (Claude — Team plan) | AI assistant used by our team to investigate specific issues with a customer's event. Not part of the Fredo product. No model training on Customer Content under Anthropic's Commercial Terms. | US | Standard Contractual Clauses (Anthropic Data Processing Addendum) | View terms |
Security assurance
Our sub-processors maintain the following independent security certifications and attestations, as published by each provider:
| Provider | Assurance |
|---|---|
| Google Cloud | ISO 27001 certified; SOC 2 attested |
| DigitalOcean | ISO 27001 certified; SOC 2 attested |
| Cloudflare | ISO 27001 certified; SOC 2 attested; EU-US Data Privacy Framework certified |
| Okta (Auth0) | ISO 27001 certified; SOC 2 Type II attested |
| Hookdeck | SOC 2 Type 2 attested; annual penetration testing |
| Scaleway | ISO 27001 (ISO/IEC 27001:2022) |
| Google Workspace | ISO 27001, ISO 27017, ISO 27018, ISO 27701 certified; SOC 2 and SOC 3 attested; EU-US Data Privacy Framework certified |
| Zoho | ISO 27001, ISO 27018, ISO 27701 certified; SOC 2 Type II attested |
| Slack | ISO 27001, ISO 27017, ISO 27018 certified; SOC 2 Type II and SOC 3 attested; EU-US Data Privacy Framework certified (via Salesforce) |
| Anthropic (Claude) | SOC 2 Type II attested; ISO 27001:2022 and ISO/IEC 42001:2023 (AI management) certified. Contractual commitment: no training on Customer Content (Team, Enterprise and API) |
Change log
- 21 October 2026: Update to sub-processors. This updated list takes effect on 20 November 2026.
- 28 August 2026: Initial publication.
Questions?
Questions about Fredo's sub-processors? Get in touch with Fredo Privacy & Compliance — privacy@hifredo.com