Subprocessors
The public list of suppliers we engage in processing personal data on our customers’ behalf (Art. 28(2) GDPR). It is part of our Data Processing Agreement.
Current list
| Supplier | Purpose | Location | Safeguards |
|---|---|---|---|
| Vercel Inc. | hosting of kaen.cz and of customer report pages, CDN | USA / EU (edge network) | DPA, EU standard contractual clauses (SCC) |
| Supabase, Inc. | database, authentication and file storage for reports, cases and leads | EU (Frankfurt region) | DPA; data stays in the EU |
| Anthropic, PBC | analysis of funnel data and drafting of findings using large language models (Claude) | USA | DPA, SCC; inputs are not used to train the models under the supplier’s commercial terms |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | card payments and invoicing | EU / USA | DPA (Data Transfers Addendum), SCC |
| Resend (Plus Five Five, Inc.) | transactional e-mail (report ready, confirmations, notifications) | EU region | DPA, SCC |
| Slack Technologies, LLC (Salesforce) | shared communication channel with the customer, notifications about findings | USA / EU | DPA, SCC |
| Google Ireland Limited | Google Workspace — e-mail, calendar and documents used to run the engagement | EU / USA | DPA, SCC |
| Stape Inc. | connector we use for read-only access to the customer’s GA4 (proxy for the analytics API) | EU / USA | DPA, SCC; read-only scope, access granted through the customer’s own Google account |
| PostHog, Inc. | product analytics of kaen.cz and of the report pages we operate | EU (EU Cloud) | DPA; data stays in the EU |
The customer’s own tools
We also work in tools that belong to the customer — GA4, Google Tag Manager, PostHog, Clarity, Hotjar, BigQuery, a payment provider, or a shared workspace such as Basecamp. We access those under the customer’s own account and contract, so they are not our subprocessors; the customer remains the controller and keeps its own agreements with those providers. We ask for read-only access wherever that is enough.
A note on AI suppliers
Analysis is done with Anthropic’s models. Under that supplier’s commercial terms, inputs are not used to train its models. We limit the risk further: we send the smallest amount of data the analysis needs, prefer aggregated and pseudonymised data over raw records, and do not send contact details where the analysis does not require them.
Changes to this list
We announce an intended addition or replacement of a subprocessor at least 30 days in advance by updating this page and e-mailing our customers. The customer (controller) may object on reasonable data protection grounds — the procedure and its consequences are described in the DPA, clause 7.
Questions about processing: hello@kaen.cz.
Version 2026-09-18, effective from 18 September 2026. List last changed: 18 September 2026.