Last updated: 2026-03-16
Midpilot AS maintains this register in accordance with GDPR Article 28. It lists all third-party sub-processors that may process personal data on behalf of Midpilot when providing the Services. Customers are notified of material changes.
| Sub-processor | Purpose | Data Categories | Location / Transfer | Sub-processor DPA |
|---|---|---|---|---|
|
Google Cloud Platform |
Cloud infrastructure — compute, storage, database (Firestore), and Cloud Run hosting | All service data including customer workspace data |
Region: EU (europe-west1/europe-west4)
|
View DPA |
|
Google Gemini API |
AI document analysis — processes uploaded bid/tender documents on customer instruction | Customer workspace data (bid documents) |
Region: EU region
|
View DPA |
|
Google Workspace (Gmail API) |
Transactional email delivery and mailbox processing — inbound/outbound service emails, activation emails, consent certificates, notifications | Name, email address, email content and metadata required for service operation |
Region: Global (Google Workspace infrastructure)
|
View DPA |
|
Microsoft OneDrive / Azure |
Customer document ingestion — receives bid documents submitted via email | Customer workspace data (bid documents) |
Region: EU
|
View DPA |
|
Stripe |
Payment processing — invoice generation and card payment handling | Billing contact details, payment references |
Region: EU
|
View DPA |