1. What this register is
A sub-processor is a vendor that processes Customer personal data on our behalf in order to provide the Service. The list is maintained in code as a single source of truth and rendered identically here and in the DPA: the two pages cannot disagree by construction.
The list is legally binding as part of the DPA — this standalone page creates and changes no obligation, it only gives the current list an address of its own.
Read the full DPA (section 5 — sub-processors)2. Current list
Alvo engages the sub-processors listed below to provide the Service. The Customer gives general consent to these engagements; we notify of additions at least 30 days before activation — the Customer may object and terminate the Service if the objection is reasonable.
| Sub-processor | Purpose | Region | Status | Data categories |
|---|---|---|---|---|
| DigitalOcean, LLC (DPA) | Application + database hosting (alvo-web, alvo-api, Postgres, Redis) | Germany (Frankfurt — fra1) | Active | all tenant data, session tokens, audit events |
| WorkOS, Inc. (DPA) | Identity, authentication, SSO, MFA, organization directory | United States (EU SCC in place) | Active | email, name, organization, MFA secrets |
| Resend, Inc. (DPA) | Transactional email delivery (welcome, billing, password reset) | United States (EU SCC in place) | Active | email address, message content, delivery metadata |
| Cloudflare, Inc. (DPA) | DNS resolution for alvo.energy / alvo.live | Global anycast | Active | domain query metadata (no application data) |
| Paddle.com Market Limited (DPA) | EU subscription billing + Merchant of Record (EUR plans) | European Union (Ireland) | Planned | billing name, address, card last-4, VAT data |
| LiqPay (PrivatBank) (DPA) | Ukrainian subscription billing (UAH plans) | Ukraine | Planned | billing identifiers, transaction metadata |
Updated whenever a new sub-processor is enabled. Active sub-processors handle tenant data today; planned ones are integrated in code but inert until a tenant-initiated event (e.g. a Paddle / LiqPay payment) activates them.
3. Notice of changes
A new sub-processor is added to this table at least 30 days before it starts handling Customer data. The date in the page header is the date this list last changed.
To receive change notifications by email, write to legal@alvo.energy and we will add your address to the DPA notification list.
Objections to a new sub-processor go to the same address within the 30-day window; a reasonable objection carries the right to terminate the Service without penalty.
4. International data transfers
The primary processing environment is European Union (DigitalOcean — Frankfurt (fra1)). Some sub-processors are located in the United States (WorkOS, Resend) — these transfers are governed by EU Standard Contractual Clauses (controller-processor and processor-sub-processor modules) and supplementary technical measures (encryption at rest + in transit, data minimization).
Copies of executed SCCs are available on request at legal@alvo.energy.
5. Public data sources (not sub-processors)
The Service reads public market-data APIs. These sources do NOT process Customer personal data — we only query public time series. Listed for full transparency:
- ENTSO-E Transparency Platform — EU electricity market data (prices, cross-border flows, load, generation)
- OREE (Ринок електричної енергії) — Ukrainian DAM / IDM hourly prices
- UEEX (Українська енергетична біржа) — Ukrainian BCM electricity indexes
- NBU (Національний банк України) — Official UAH/EUR + UAH/USD reference rates
- Open-Meteo — Weather data for load/generation context
We will send the sub-processor list as an extract of the signed DPA — for tenders, security questionnaires, or enterprise onboarding.
legal@alvo.energy