1. What this register is
A sub-processor is a vendor that processes Customer personal data on our behalf in order to provide the Service. The list is maintained in code as a single source of truth and rendered identically here and in the DPA: the two pages cannot disagree by construction.
The list is legally binding as part of the DPA — this standalone page creates and changes no obligation, it only gives the current list an address of its own.
Read the full DPA (section 5 — sub-processors)2. Current list
Alvo engages the sub-processors listed below to provide the Service. The Customer gives general consent to these engagements; we notify of additions at least 30 days before activation — the Customer may object and terminate the Service if the objection is reasonable.
| Sub-processor | Purpose | Region | Status | Data categories |
|---|---|---|---|---|
| DigitalOcean, LLC (DPA) | Application + database hosting (alvo-web, alvo-api, Postgres, Redis) | Germany (Frankfurt — fra1) | Active | all tenant data, session tokens, audit events |
| WorkOS, Inc. (DPA) | Identity, authentication, SSO, MFA, organization directory | United States (EU SCC in place) | Active | email, name, organization, MFA secrets |
| Resend, Inc. (DPA) | Transactional email delivery (welcome and account notices, demo-request notifications, emails you opt into) | United States (EU SCC in place) | Active | email address, message content, delivery metadata |
| Cloudflare, Inc. (DPA) | Authoritative DNS, reverse proxy / CDN / WAF, and edge TLS termination for alvo.energy / alvo.live | Global anycast edge network (including non-EU locations) | Active | IP addresses and DNS/HTTP request metadata, HTTP headers (including cookies), request and response content, cached public content and static assets |
Updated whenever a new sub-processor is engaged. Active sub-processors handle data today. The Service uses no payment provider: no payment is collected.
3. Notice of changes
A new sub-processor is added to this table at least 30 days before it starts handling Customer data. The date in the page header is the date this list last changed.
To receive change notifications by email, write to legal@alvo.energy and we will add your address to the DPA notification list.
Objections to a new sub-processor go to the same address within the 30-day window; a reasonable objection carries the right to terminate the Service without penalty.
4. International data transfers
The primary data processing and storage environment is European Union (DigitalOcean — Frankfurt (fra1)). Database backups are also held in Ukraine — at the controller's place of registration. Some sub-processors are located in the United States (WorkOS, Resend) — these transfers are governed by EU Standard Contractual Clauses (controller-processor and processor-sub-processor modules) and supplementary technical measures (encryption at rest + in transit, data minimization).
Copies of executed SCCs are available on request at legal@alvo.energy.
5. Market-data sources (not sub-processors)
The Service reads public and licensed third-party market-data sources. These sources receive no Customer personal data — we only request their time series. The data stay under their providers' licences: Alvo claims no rights in them and attributes the source wherever the licence requires. Which of them are live right now is shown on /status.
- ENTSO-E Transparency Platform — European electricity-market data: cross-border flows, load, generation, and day-ahead prices
- Market Operator of Ukraine (OREE) — Ukrainian day-ahead (DAM) and intraday (IDM) market prices and volumes
- Ember — European wholesale electricity prices and carbon intensity (CC BY 4.0)
- Energy-Charts (Fraunhofer ISE) — day-ahead prices for selected EU zones — only where the source itself declares a CC BY 4.0 licence
- PSE — Raporty OSP (Polish transmission system operator) — Poland's market price of electricity (RCE) at 15-minute resolution — a reference for the Ukraine–Poland basis
- energy-map.info — licensed aggregator of Ukrainian market data, including Ukrenergo data; shown only as aggregated or derived values, with attribution
- JAO (Joint Allocation Office) — cross-border capacity auction results
- ENTSOG Transparency Platform — gas-transmission flows as context for power prices
- GIE AGSI+ (Gas Infrastructure Europe) — European gas-storage fullness as fuel-system context; not used as a price-forecast input
- National Bank of Ukraine (NBU) — official UAH/EUR and UAH/USD reference rates
- Open-Meteo — weather data for load and generation context
- ukrainealarm (api.ukrainealarm.com) — air-raid alert status
- Ukrenergo — public announcements of the transmission system operator
- Yasno — public power-outage schedules
- NEURC, Ukraine's energy regulator — official regulator publications — links to the original and derived status only
We will send the sub-processor list as an extract of the signed DPA — for tenders, security questionnaires, or enterprise onboarding.
legal@alvo.energy