Subprocessors & Third-Party Services
Categories of providers used to deliver the service.
- Version
- 1.0
- Effective date
- 17 August 2026
- Last updated
- 17 August 2026
- Document owner
- the Groundmaster project, with responsibility assigned to its legal and compliance function
- Applicable jurisdiction
- Portugal, European Union
- Permanent URL
- https://www.groundmaster.pt/legal/subprocessors
1.How we select and control providers
Providers are assessed for security, data protection, reliability and, where relevant, transfer safeguards before use. Each is engaged under written terms that impose confidentiality, security and processing restrictions no less protective than the Data Processing Terms, and access is limited to what the provider needs to perform its function.
2.Provider categories
| Category | Function performed | Data categories | Region |
|---|---|---|---|
| Cloud hosting and application runtime | Running the application, request routing, edge delivery | All Content processed in the course of requests, technical metadata | the European Economic Area (EEA), where technically available; any processing by third-party subprocessors outside the EEA is subject to appropriate GDPR safeguards, including Standard Contractual Clauses where applicable |
| Managed database and file storage | Persistent storage of records and uploaded documents, backups | Workspace Content, uploaded documents, audit data | the European Economic Area (EEA), where technically available; any processing by third-party subprocessors outside the EEA is subject to appropriate GDPR safeguards, including Standard Contractual Clauses where applicable |
| Authentication and identity | Account authentication, session and token management, federated sign-in where enabled | Identity and credential metadata | the European Economic Area (EEA), where technically available; any processing by third-party subprocessors outside the EEA is subject to appropriate GDPR safeguards, including Standard Contractual Clauses where applicable |
| Transactional email delivery | Account, security and notification messages | Name, email address, message content | [provider regions] |
| AI model inference | Generating AI-assisted suggestions, summaries and retrieval answers on request | Prompt content and the retrieved context needed for the request | [provider regions] |
| Monitoring, logging and error diagnostics | Availability monitoring, performance measurement, error diagnosis | Technical metadata, diagnostic events | [provider regions] |
| Security and abuse prevention | Traffic filtering, rate limiting, bot and abuse mitigation | Request metadata, IP address | [provider regions] |
| Billing and payment processing | Subscription billing, invoicing and payment handling where applicable | Commercial contact and billing data | [provider regions] |
| Support tooling | Handling and tracking support requests | Support correspondence and attachments | [provider regions] |
| Backup and disaster recovery | Storage of backup copies and restoration testing | Backup copies of workspace Content | the European Economic Area (EEA), where technically available; any processing by third-party subprocessors outside the EEA is subject to appropriate GDPR safeguards, including Standard Contractual Clauses where applicable |
3.Changes and objections
We will give notice before adding or replacing a category of provider that processes Customer Data. Customers may object on reasonable data protection grounds; where an objection cannot be resolved, the affected functionality may be limited or the Subscription may be terminated for the affected part.
4.Requesting the current list
A current list of named providers, their functions and their processing locations is available on request through the legal requests page.
Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 17 August 2026 | Initial category-based provider inventory. |
Questions about this document can be sent to groundmaster.web@gmail.com. Formal legal, privacy, security and regulatory requests should follow the routes described in the legal requests page. Fields shown as bracketed placeholders are pending confirmation by the operating legal entity and do not constitute a statement of fact.