Legal
Subprocessors
The companies that host, store, email and bill for GarnerDocs, and what each one does.
Last updated
This page lists the companies GarnerDocs uses to run the service, in two groups:
- Subprocessors for Client Documents process the files and details a firm's clients send through GarnerDocs, on the firm's behalf. Our Data Processing Agreement covers them.
- Other service providers help us run GarnerDocs as a business, for example by taking payments. They don't process Client Documents.
Subprocessors for Client Documents
We only use a subprocessor for Client Documents under written terms that protect them to the same standard as our DPA, and we stay responsible to the firm for its work.
| Subprocessor | Purpose | Data processed | Location | Transfer safeguards | Added or changed |
|---|---|---|---|---|---|
| Laravel Forge (Laravel Holdings Inc.) forge.laravel.com | Sets up, updates and deploys the GarnerDocs servers in our Amazon Web Services account. It has administrator access to those servers, but doesn't store the data itself. | Everything held on our servers, which it can reach through its administrator access: firm accounts, client details, requests, notes and the database. | United States. The servers it manages are in Frankfurt, Germany. | EU-U.S. Data Privacy Framework (Laravel Holdings Inc. is certified), under Laravel's Data Processing Agreement. | |
| Amazon Web Services (Amazon Web Services EMEA SARL) aws.amazon.com | Provides the servers, the database and Redis (sessions, cache and queues) the app runs on, and stores database backups. | Everything held in GarnerDocs, as above, emails waiting in the queue, and database backups until they expire. | Frankfurt, Germany (AWS region eu-central-1). | Data stays in the EU. AWS's Data Processing Addendum includes the EU Standard Contractual Clauses for any access from outside the EEA. | |
| Amazon Web Services (Amazon S3) aws.amazon.com | Stores the files clients upload and the ZIP exports firms download, in a private, encrypted bucket. Amazon GuardDuty scans each file stored there for malware, in the same region. | Uploaded files and ZIP exports, and earlier versions of deleted files until they expire. | Frankfurt, Germany (AWS region eu-central-1). | Data stays in the EU. AWS's Data Processing Addendum includes the EU Standard Contractual Clauses for any access from outside the EEA. | |
| Amazon Web Services (Amazon Bedrock) aws.amazon.com/bedrock/ | Runs Claude, an AI model made by Anthropic, for automatic document checks: if a firm turns them on, each file its clients upload is compared with what the firm asked for. Anthropic can't access the files. | The uploaded files a check reads (PDFs and images), with the request title and the requested document's name and description. Only for firms that turn checks on. | AWS regions in the EU: Frankfurt (Germany), Ireland, Paris (France), Milan (Italy), Spain and Stockholm (Sweden), through Amazon Bedrock's EU inference profile. | Data stays in the EU, and our Bedrock account is set not to retain inputs or outputs. AWS's Data Processing Addendum includes the EU Standard Contractual Clauses for any access from outside the EEA. | |
| Cloudflare (Cloudflare, Inc.) www.cloudflare.com | Sits in front of GarnerDocs to protect it against attacks and pass traffic on to our servers. To do that, it decrypts the traffic as it passes through. | Everything sent to and from GarnerDocs as it passes through, including pages, uploaded files and IP addresses. It doesn't keep files. | Worldwide, in the Cloudflare data centre nearest the visitor. Cloudflare, Inc. is in the United States. | EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum. | |
| Mailgun (Mailgun Technologies, Inc., part of Sinch) www.mailgun.com | Sends the emails GarnerDocs sends: requests and reminders to clients, and notifications to firms. Tells us when an address bounces or reports spam. | Names and email addresses of the people we email, and what the emails say: the firm's name, request titles, messages, document names and links. | EU region, in Germany and Belgium. Support staff in the United States may access data. | EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses, under the Sinch Data Processing Agreement. | |
| Google Workspace (Google Cloud EMEA Limited) workspace.google.com | Hosts our support mailbox, which receives messages from Help & Support, requests about personal data, and abuse and security reports. | Messages from a firm's team, and any client details they include. | Google Cloud EMEA Limited is in Ireland. Email may be processed wherever Google has data centres, including the United States. | EU-U.S. Data Privacy Framework (Google LLC is certified), with the EU Standard Contractual Clauses as a fallback, under Google's Cloud Data Processing Addendum. |
Scroll sideways to see every column on a small screen.
Other service providers
| Service provider | Purpose | Data processed | Location | Transfer safeguards | Added or changed |
|---|---|---|---|---|---|
| Stripe (Stripe Payments Europe, Limited) stripe.com | Takes subscription payments, calculates VAT and keeps billing records for firms. Handles GarnerDocs's own billing, not Client Documents. | The firm's name, billing address and VAT ID, the owner's email address and payment details. Card details are entered on Stripe's own pages and never reach GarnerDocs. | Ireland, with transfers to Stripe, LLC in the United States. | EU-U.S. Data Privacy Framework (Stripe, LLC is certified), then the EU Standard Contractual Clauses, under Stripe's Data Transfers Addendum. | |
| Google Analytics (Google Ireland Limited) marketingplatform.google.com/about/analytics/ | Measures how people find and use our public website, only for visitors who accept analytics cookies. It isn't used in the GarnerDocs app or on client upload pages. | The pages visited on our website, how the visitor got there, their device and browser, an approximate location worked out from their IP address, and a random ID kept in a cookie. Google Analytics doesn't store IP addresses. | Google Ireland Limited is in Ireland. Data may be processed wherever Google has data centres, including the United States. | EU-U.S. Data Privacy Framework (Google LLC is certified), with the EU Standard Contractual Clauses as a fallback, under the Google Ads Data Processing Terms. | |
| Crisp (Crisp IM SAS) crisp.chat | Runs the chat on our public website, so visitors can ask us questions. It isn't used in the GarnerDocs app or on client upload pages. | The messages a visitor sends us in the chat and any email address they give, the page they're on, their browser and device, their IP address, and a random ID kept in a cookie once they open the chat. | France. Crisp keeps conversations on servers in the Netherlands, Germany and France, and backups in Ireland. Some of its providers are US companies. | Data is stored in the EU. Crisp relies on the EU Standard Contractual Clauses where its providers transfer data outside the EU, under its Data Processing Agreement. |
Scroll sideways to see every column on a small screen.
Stripe handles firms' billing. Google Analytics measures visits to our public website, only for visitors who accept analytics cookies. Crisp runs the chat on our public website.
Changes to this list
Before we add or replace a subprocessor for Client Documents, we'll update this page and email the owner of each workspace at least 30 days before the change takes effect. The email says what changes and when.
A firm that objects to a change on reasonable data protection grounds can tell us at [email protected] before that date. We'll try to resolve the objection, for example by explaining the safeguards. If we can't, the firm may end its agreement with us with effect from the date of the change, and we'll refund any fees it has paid for the period after that date.
In an emergency, such as a security incident or a provider stopping its service, we may replace a subprocessor sooner. We'll tell firms as soon as we can, and they can still object and end the agreement as above.
The "Added or changed" column shows when each provider was added to this list or its entry last changed.
Webhooks you set up
If a firm sets up webhooks, GarnerDocs sends the event data to the URLs the firm chooses, including links to download its clients' files. The firm chooses and controls those recipients, so they aren't GarnerDocs subprocessors.
Questions
If you have a question about a subprocessor, contact us at [email protected]. Our Security page describes how we protect data, and our Privacy Policy explains what we collect.
GarnerDocs is provided by Waseem S. M. Abusenjr, trading as GarnerDocs, Alte Landstr. 85, 51373 Leverkusen, Germany. Our legal notice has our full details.