Sub-processors

To operate KairosLink, MITS GROUP LLC relies on the providers listed below. All of them act as sub-processors: they process personal data on our behalf, following our instructions and under contractual obligations equivalent to those we accept in the Data Processing Agreement. This list forms part of that agreement.

Three things worth knowing before reading the list

The relay server does not decrypt anything. Remote control, remote terminal and file transfer travel end-to-end encrypted between the console and the managed endpoint: the relay transports that traffic and has no access to screen content, keystrokes, transferred files or terminal sessions.

Backups leave the European Union. They are stored on Google Drive and OneDrive, in the United States, encrypted with AES-256 and with encrypted file names; the keys never leave our infrastructure. We say it here rather than in a footnote because it is a transfer to a third country, even though the content is not readable by the storage provider.

The list

The order is not alphabetical: first what touches service data, then business services, and accessory services last. The status of each one says whether it is in the data path today or contracted and not yet.

Hetzner Online GmbH

• Purpose: Panel server, database, files and outbound email.
• Processing region: Nuremberg, Germany
• Legal basis for the transfer: Processing within the European Economic Area. No international transfer takes place.
• Status: In use.
• Data protection documentation: https://www.hetzner.com/legal/privacy-policy/

Hetzner Online GmbH

• Purpose: European relay server (relay-eu.kairoslink.io), for transporting remote access.
• Processing region: Falkenstein, Germany
• Legal basis for the transfer: Processing within the European Economic Area. No international transfer takes place.
• Status: Contracted and provisioned, not yet in production: it processes no data today.
• Data protection documentation: https://www.hetzner.com/legal/privacy-policy/

Akamai Technologies, Inc. (Linode)

• Purpose: Americas relay server (relay.kairoslink.io), for transporting remote access.
• Processing region: São Paulo, Brazil
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://www.akamai.com/legal/privacy-and-policies

Cloudflare, Inc.

• Purpose: DNS, edge protection and content delivery for the public site and the panel.
• Processing region: Global network, with nodes in the European Union
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://www.cloudflare.com/cloudflare-customer-dpa/

Stripe, LLC / Stripe Payments Europe, Limited

• Purpose: Subscription payments and billing.
• Processing region: Ireland and United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://stripe.com/legal/dpa

Microsoft Corporation / Microsoft Ireland Operations Limited

• Purpose: Corporate email (Microsoft 365) and the module that integrates with customers' Microsoft 365 tenants.
• Processing region: European Union and United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

Anthropic PBC

• Purpose: Artificial intelligence features: public chat, assisted command generation and drafting of knowledge base articles.
• Processing region: United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://www.anthropic.com/legal/commercial-terms

GitHub, Inc.

• Purpose: Compilation and distribution of the agent installers.
• Processing region: United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement

Google LLC

• Purpose: Storage of encrypted backups.
• Processing region: United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://cloud.google.com/terms/data-processing-addendum

Microsoft Corporation

• Purpose: Storage of encrypted backups.
• Processing region: United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: In use.
• Data protection documentation: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

AC PM LLC (Postmark)

• Purpose: Transactional email.
• Processing region: United States
• Legal basis for the transfer: Standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor).
• Status: Configured and available, currently outside the active data path.
• Data protection documentation: https://postmarkapp.com/dpa

UptimeRobot

• Purpose: External availability monitoring of the service.
• Processing region: European Union
• Legal basis for the transfer: Processing within the European Economic Area. No international transfer takes place.
• Status: In use.
• Data protection documentation: https://uptimerobot.com/privacy/

Transfers outside the European Union

Transfers to countries without an adequacy decision from the European Commission are made on the basis of the standard contractual clauses of Implementing Decision (EU) 2021/914, module 2 (controller to processor), supplemented by the technical measures described in the Data Processing Agreement.

How to object to a sub-processor

Notice of a new sub-processor arrives by email 30 days in advance. To object on data protection grounds, reply to that notice or write to [email protected] before the period expires. If we cannot reach an agreement, you may terminate the contract as of the date of the intended change, with no notice period, and periods already paid for and not used are refunded pro rata.

Relationship with the other documents

This list forms part of the Data Processing Agreement and supplements the Privacy Policy, which describes what data we process and for what purpose.

Postal address

MITS GROUP LLC 2201 Menaul Blvd NE Ste A Albuquerque, NM 87107 United States

Governing language

This document is a translation provided for convenience only. The Spanish-language version is the legally binding text, and in the event of any discrepancy or conflict between the versions, the Spanish version shall prevail.