DWS IQ Platform — GDPR Article 28 Transparency
The following sub-processors are authorized to process Personal Data on behalf of the Customer in connection with the DWS IQ platform services. Tier-specific sub-processors are listed in the next section. This list is maintained as Annex A of the Data Processing Agreement.
| Sub-processor | Purpose | Parent | Data Location | Data Processed |
|---|---|---|---|---|
| Supabase Inc. | Database hosting, authentication, real-time services | USA | EU Finland/Germany | All platform data, user authentication data |
| Google Cloud (Google LLC) | Cloud Run compute services, AI APIs (Gemini) | USA | EU Finland | Application processing data, AI inference data |
| Cloudflare Inc. | CDN, edge computing (Workers), DDoS protection | USA | EU EU edge nodes | Web traffic metadata, cached content |
| Anthropic PBC | AI language model services (Claude API) | USA | USA + SCC | Anonymized/pseudonymized compliance analysis data |
| Groq Inc. | AI inference acceleration | USA | USA + SCC | Anonymized/pseudonymized AI processing data |
| Temporal Technologies Inc. | Workflow orchestration | USA | EU | Workflow metadata, task identifiers |
| Shufti Pro Limited | Identity verification (KYC/IDV) | UK | EU only | Biometric data (facial images), identity documents, verification results |
These apply only when your contract names the tier (DPA, “Application: DWS Product Tiers & Jurisdictions”).
| Tier | Sub-processor | Purpose | Parent | Data Location |
|---|---|---|---|---|
| DWS IQ 7 Aegis | Hetzner Online GmbH | Compute and storage | Germany | EU Helsinki, Finland |
| DWS IQ 7 Aegis | Aiven Oy | Managed PostgreSQL, Article 12 logging ledger | Finland | EU Finland |
| DWS IQ 7 Aegis | UpCloud Oy | Infrastructure under the Aiven service | Finland | EU Finland |
| DWS IQ Sovereign Infra | Scaleway SAS | EU cloud hosting | France | EU EU regions |
| DWS IQ Connect | Customer-selected cloud (AWS, Azure, Google Cloud, NVIDIA) | Hosting in the region you choose | USA | EU, US, APAC or MENA, per contract; SCC for transfers outside the EEA |
Supabase, Google Cloud, Cloudflare and Temporal store and process data in EU regions. Their parent companies are in the USA, so US law, including the CLOUD Act, can reach them even when the data stays in the EU. We state this rather than call it sovereignty. Each provider’s data processing terms apply, including its transfer mechanism for any access from outside the EEA. Shufti Pro processes data in the EU/EEA only (see below). Customers who need no US-parent provider in the data path choose the Aegis tier.
Standard Contractual Clauses (SCC) per Commission Implementing Decision (EU) 2021/914 are in place. Supplementary measures include:
Shufti Pro processes biometric data (GDPR Article 9 special category) exclusively within EU/EEA data centers. EU-only processing and storage confirmed in writing by Shufti Compliance (2026-04-02) and contractually embedded in the Shufti DPA addendum. Underlying infrastructure (Google Cloud) is locked to EEA regions only. Sub-processor Programmers Force (Pakistan) is not applicable to the Lifetime Oy account under EU-only mode. Biometric data is deleted after verification completion per agreed retention schedule.
Vendor verification: company registration and DPA signatory verified; clause-by-clause DPA audit completed April 2026. Details are available to customers under NDA.
Accuracy trade-off (transparency note): Under EU-only mode, Shufti does not perform model training on Lifetime Oy customer data and does not route uncertain verifications to non-EU manual reviewers. ML training prohibition is contractually binding (DPA addendum Clause 6). Lifetime Oy accepts this trade-off in favour of full EU data sovereignty, and maintains an internal secondary verification layer to handle borderline cases.
Per DPA Article 7.4: Lifetime Oy will notify customers 30 days in advance of any changes to this sub-processor list. Customers may raise objections if the change is contrary to Data Protection Regulations.
To subscribe to sub-processor change notifications, contact privacy@lifetime.fi.
| Date | Change | Sub-processor |
|---|---|---|
| 2026-10-13 | Clarified | Parent-company jurisdiction shown for every provider; tier-specific sub-processors (Aegis, Sovereign Infra, Connect) listed as stated in the DPA |
| 2026-04-08 | DPA audit completed | Shufti Pro Limited — clause-by-clause DPA audit; company register verification; ML training prohibition clause added; Art. 9 legal basis clause added |
| 2026-04-05 | Confirmed EU-only | Shufti Pro Limited — EU-only processing + GCP EEA lock contractually embedded; Programmers Force (PK) excluded |
| 2026-04-01 | Added | Shufti Pro Limited (KYC/IDV, EU-only processing) |
| 2026-02-05 | Initial list | Supabase, Google Cloud, Cloudflare, Anthropic, Groq, Temporal |