Intellix IT Solutions
Subprocessors

Every third party we share data with — listed.

We keep our stack small on purpose. The full list of subprocessors is below — name, role, jurisdiction, transfer mechanism, link to their privacy policy. Updated whenever we change a vendor. Material additions are emailed to clients with an active engagement.

Last updated: February 2026

MongoDB Atlasprivacy policy ↗

Role
Primary database (leads, scan logs, visits, admin users)
Jurisdiction
Ireland (eu-west-1) — EU data jurisdiction
Transfer mechanism
No transfer outside EU/UK in normal operation
Notes
Encrypted at rest (AES-256). Network-restricted; only the app backend can connect.

Cloudflare, Inc.privacy policy ↗

Role
Edge protection, DNS, anti-DDoS, bot management
Jurisdiction
Global edge — UK/Ireland points of presence for European traffic
Transfer mechanism
Standard Contractual Clauses (SCCs) under EU Commission Decision 2021/914 + UK IDTA Addendum
Notes
Sets the __cf_bm and cf_clearance cookies described in the Cookie Policy.

Hetzner Online GmbHprivacy policy ↗

Role
Application & API hosting
Jurisdiction
Germany / Finland (EU)
Transfer mechanism
No transfer outside EU
Notes
ISO/IEC 27001 certified data centres.

Amazon Web Services (AWS)privacy policy ↗

Role
Backups, secondary infrastructure, file storage (selected workloads)
Jurisdiction
eu-west-1 (Ireland) only
Transfer mechanism
AWS European Sovereign Cloud commitments; SCCs in place
Notes
Used only where Hetzner does not offer the specific managed service we need.

SMTP relay provider (Resend / Mailgun-class)privacy policy ↗

Role
Outbound email delivery (PDF brief, lead notifications, admin alerts)
Jurisdiction
EU region
Transfer mechanism
SCCs where US headquartered; EU sub-processor list reviewed annually
Notes
Only email envelope, subject and body transit the relay. No marketing-list sync.

Stripe Payments Europe, Ltd.privacy policy ↗

Role
Payment processing for paid engagements (when invoiced via Stripe)
Jurisdiction
Ireland
Transfer mechanism
EU-controller model
Notes
Used only for invoicing of paid engagements. Card data never touches our infrastructure (Stripe-hosted forms).

Customer-asset CDN (Emergent / hosted assets)

Role
Static image hosting (logos, marketing visuals)
Jurisdiction
Global CDN edge
Transfer mechanism
SCCs in place where applicable
Notes
Contains marketing assets only; no personal data passes through this surface.

Notifications of changes

Clients on an active engagement receive an email notification before any new subprocessor goes live. Public visitors can subscribe to the changelog (very low volume, two or three updates a year) by emailing hello@cloudvoro.com with "subscribe subprocessor changelog" in the subject.

Right to object

If a new subprocessor is materially objectionable to you (e.g. a jurisdictional concern under your own compliance regime), notify us within 30 days of the announcement. We will work with you to scope an alternative or, if neither party can reasonably accept, allow you to terminate the relevant engagement without penalty for that issue.

Privacy Notice·Data Processing·Cookies·Terms