Sub-processors List - TLI S.A. / EasyBoard

Version: 1.0

Last Updated: March 2026

Document ID: EB-SUB-2026-001

This document lists all sub-processors engaged by TLI S.A. in the provision of the EasyBoard service. In accordance with Article 28(2) of the GDPR and the Data Processing Agreement, the Controller is informed of any changes to this list and has the right to object within 30 calendar days.

Authorized Sub-processors

Name	Purpose	Location	Safeguards
Anthropic LLC	AI text generation (Claude API) used to generate structured board meeting minutes from transcriptions	USA Non-EU	Zero-retention API: no customer data stored or logged No training on customer data Data Processing Agreement in place SOC 2 Type II certified Data processed in-memory only, not persisted
Google Cloud / Firebase	User authentication, Firestore database, Cloud Storage for temporary file handling	EU (europe-west1, Belgium) EU	GDPR Data Processing Agreement SOC 2 Type II certified ISO 27001, ISO 27017, ISO 27018 certified Data residency in EU region AES-256 encryption at rest
EdenAI SAS	Speech-to-text transcription of audio recordings of board meetings	France (EU) EU	GDPR compliant, EU-based processing Audio data processed in transit, not retained Data Processing Agreement in place
Netlify Inc.	Web application hosting, serverless functions for backend processing	EU compute, global CDN EU	GDPR Data Processing Agreement SOC 2 Type II certified EU compute region for serverless functions DDoS protection
Stripe Inc.	Payment processing, subscription management, invoicing	EU EU	PCI DSS Level 1 certified GDPR Data Processing Agreement SOC 2 Type II certified No payment card data touches EasyBoard systems
Resend Inc.	Transactional email delivery (account notifications, password resets)	USA Non-EU	GDPR Data Processing Agreement Limited data: email addresses and message metadata only No access to board meeting content or minutes SOC 2 Type II certified
CloudConvert GmbH	Document format conversion (generation of DOCX files from minutes)	Germany (EU) EU	GDPR compliant, EU-based processing Files deleted after conversion Data Processing Agreement in place ISO 27001 certified

Note on international transfers: Two sub-processors (Anthropic LLC and Resend Inc.) are based in the United States. For Anthropic, the transfer risk is mitigated by the zero-retention API policy: no personal data is stored, logged, or persisted outside the EU. Data is processed in-memory only and discarded immediately after the API response is generated. For Resend, only email addresses are transmitted; no board meeting content is shared. Both providers have executed GDPR-compliant Data Processing Agreements.

Change Notification Process

In accordance with the Data Processing Agreement:

The Controller will be notified by email at least 30 calendar days before any new sub-processor is engaged or an existing sub-processor is replaced.
The Controller may object to the change in writing within 30 calendar days of receiving the notification.
If the Controller objects and TLI S.A. cannot reasonably accommodate the objection, either party may terminate the affected services.
An updated version of this document will be published at easyboard.lu/documents/subprocessors.html whenever changes occur.

Contact

For questions regarding sub-processors or to subscribe to change notifications:

Email: governance@easyboard.lu