Subprocessors
Subprocessors
How we work with third parties
Reqme SAS uses a limited set of third-party providers to deliver the service.
Where a provider processes personal data on our behalf (a
processor), that processing is governed by data-protection terms
incorporated into our agreement with them, as required by Article 28 GDPR.
Certain providers — including payment institutions and banks — act as
independent controllers under their own regulatory obligations;
in those cases we share only the data necessary and each party is responsible for
its own compliance. Identity-verification providers may act in a dual
role (processor for verification we request; independent controller for
their own regulatory retention).
Current providers
| Provider | Purpose | Role | Region |
|---|---|---|---|
| Stripe | Payments & subscriptions | Independent controller | USA / EU |
| Mollie | Payments | Independent controller | EU |
| Paysera | Payments | Independent controller | EU (LT) |
| Monobank | Payments (hosted checkout, mainly Ukrainian merchants/clients) | Independent controller | Ukraine — Art 49(1)(b) (necessary to execute the payment). Card data is entered on Monobank’s page; Reqme sends only invoice/amount metadata, no card or contact data. |
| PayPal | Payments | Independent controller | EU / USA |
| Didit | Identity verification (KYC) | Dual role — processor for verification, controller for own AML/audit retention | EU/USA |
| Dokapi | E-invoicing (Peppol) & KYC document processing | Processor (controller for Peppol transmission) | EU |
| OpenAI | AI model inference (via our gateway) | Processor | USA |
| Google (Gemini) | AI model inference (via our gateway) | Processor | USA / EU |
| Langfuse | AI observability / tracing | Processor | EU (cloud.langfuse.com) |
| Amazon Web Services | Hosting, email (SES), queue (SQS), realtime (AppSync) | Processor | USA (us-east-1) |
| Amplitude | Product analytics | Processor | EU (EU data region) |
| Appzi | In-product feedback widget | Processor | USA |
| ipgeolocation.io | IP-based security notifications | Processor | Pakistan (receives IP address only) |
Transfers outside the EEA rely on EU Standard Contractual Clauses, or the
EU-US Data Privacy Framework where the recipient is certified, or another lawful
mechanism. EU/EEA providers (Mollie, Paysera, Dokapi, Langfuse, Amplitude) involve no restricted transfer. US providers (Stripe, PayPal, OpenAI, Google, AWS, Appzi) rely on the EU-US Data Privacy Framework where certified, otherwise Standard Contractual Clauses. Monobank (Ukraine) and ipgeolocation.io (Pakistan) receive limited data (payment metadata / IP address respectively) under Article 49(1)(b) or SCCs.
Changes to this list
We may add or replace providers as the service evolves. Material changes to
processors will be reflected here. Customers with a Data Processing Agreement may
subscribe to change notifications as set out in that agreement.
Contact
Questions: hi@reqme.co.