Sub-processors
Last updated: May 2026
Atome processes customer data using a small number of carefully vetted sub-processors. All listed sub-processors are bound by a Data Processing Agreement (DPA) with standard contractual clauses where applicable. Customers are notified at least 30 days in advance of any material change to this list.
Current sub-processors
| Sub-processor | Service provided | Data processed | Location | Independent certifications |
|---|---|---|---|---|
| UpCloud Ltd. | Compute, object storage, network | All Atome application data (compute and files) | Frankfurt DE / Helsinki FI / Amsterdam NL (EU) | ISO/IEC 27001, 27017, 27018, PCI-DSS, GDPR |
| Aiven Oyj | Managed Postgres database | All Atome relational data (workspaces, records, configurations) | Germany (EU, on UpCloud) | SOC 2 Type II, ISO/IEC 27001, 27017, 27018, HIPAA, PCI-DSS |
| Google LLC (Gemini API) | AI-assisted email enrichment for US-hosted mailboxes (opt-in per mailbox; Gmail / Google Workspace, standard Microsoft 365 / Outlook). Routing between Gemini and Mistral is automatic based on mailbox residency. | Email content of opted-in US-hosted mailboxes — already stored by the customer with their chosen US-based email provider | Google EU regions configured; the mailbox content was already hosted in the US by the customer's chosen email provider, so enrichment does not move data from an EU surface to a US one | SOC 2 Type II, ISO/IEC 27001, 27017, 27018 |
| Mistral AI SAS | AI-assisted email enrichment for EU-hosted mailboxes (Microsoft 365 EU Data Boundary tenants, Proton Mail, Mailbox.org, etc.). Routing between Gemini and Mistral is automatic based on mailbox residency. | Email content of opted-in EU-hosted mailboxes | France / EU (Mistral La Plateforme) — fully intra-EU processing | DPA signed; SCCs not required (intra-EU) |
Service providers (not sub-processors)
The following providers handle metadata or non-customer-content only, and are therefore not classed as sub-processors of customer data. We list them here for transparency:
- Bunny.net — CDN for public site assets only (no customer data).
- Self-hosted Sentry — error monitoring, runs on Atome's UpCloud Frankfurt infrastructure.
- Self-hosted Grafana and Prometheus — operational metrics, run on Atome's UpCloud infrastructure.
Transactional email metadata (delivery receipts, bounce notifications) is handled by a dedicated email service provider. The selected provider will be listed here once finalised.
Notification of changes
To subscribe to notifications of changes to this list, send an email to legal@atome.sh. Subscribers receive at least 30 days' prior notice before any new sub-processor is added, except where immediate change is required to remediate a security incident. Changes are also reflected on this page.
Contact
For any question about sub-processors, privacy, security, or contractual notices, contact legal@atome.sh.