Sub-processor List

Filetable uses the sub-processors below to provide the service. For each of them, the list states the legal entity, its role, the countries where it may process personal data and the safeguard relied on for transfers.

For AI processing, Filetable uses one or more of the AI providers listed in section 3 and may route any task to any of them. This list does not state which provider performs which task.

Customer documents and the application database are stored in Switzerland, on Microsoft Azure (Zurich region). Where a provider offers processing in Europe, we currently prefer it; this describes our practice and is not a commitment as to where processing takes place.

We give at least 30 days' notice of any addition or replacement, with a right to object (section 6). The date of the current list is shown at the top of this page, and its changes are recorded in section 7.

The service, its database and customer documents are hosted by Microsoft Azure in Switzerland. Files are encrypted with individual keys that are not stored in the storage service.

Filetable uses one or more of the AI providers below to read documents — text recognition, extraction, classification and matching — and to compute the representations used for search. Filetable chooses the provider and the model for each task and may route any task to any provider in this section; how processing is distributed among them is not a change to this list.

Each provider processes customer content under a data processing agreement with Filetable that prohibits it from using that content to train or improve its models. A provider may keep a request for a limited period where its terms require it for security and abuse monitoring.

These providers may process personal data in Switzerland, the EU/EEA, the United States and other countries where they operate. Where a provider offers processing in Europe, we currently prefer it; this is not a commitment as to where processing takes place.

Stripe does not process customer documents or extracted data. It processes billing and payment data and, for customers outside Switzerland, acts as merchant of record and as a separate controller for the purchase.

Filetable's email is listed because support requests, which may contain personal data from customer content, reach us by email.

Cloudflare provides the domain name system for Filetable's domains. When traffic protection is enabled for a website, the traffic between the browser and the service passes through its network.

Filetable's operational monitoring runs on infrastructure operated by Filetable and does not involve a third-party provider.

Transfers from Switzerland to the EU/EEA and to the other states on the Federal Council's list of countries with adequate data protection (Article 16(1) FADP and Annex 1 OPDo) require no additional safeguards. Transfers to the United States rely on the Swiss–U.S. Data Privacy Framework (recognised by the Federal Council with effect from 15 September 2024) and the EU–U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified recipients and, otherwise, as for any other country without adequate protection, on the European Commission's Standard Contractual Clauses with the adaptations required for transfers from Switzerland (Article 46 GDPR, Article 16(2) FADP).

For customers established in the EU/EEA, Switzerland benefits from an adequacy decision of the European Commission, so transfers to Filetable in Switzerland require no additional safeguards. Filetable provides the transfer mechanism relied on for any sub-processor on request.

The customer has given Filetable general written authorisation to engage the sub-processors on this list (Article 28(2) GDPR, Article 9(3) FADP), as set out in section 7 of the Data Processing Agreement.

Before adding or replacing a sub-processor, Filetable gives at least 30 days' notice by email to the administrative contacts of each workspace and updates this list with the date of the change. How processing is distributed among sub-processors already on the list is neither an addition nor a replacement.

A customer may object to a new sub-processor on reasonable data protection grounds by writing to privacy@filetable.com within the notice period. If no reasonable solution is found within 30 days of the objection, the customer may terminate the affected service, with a pro-rata refund of prepaid fees for the unused remainder of the term.

Where a sub-processor must be replaced urgently for security, legal or availability reasons, Filetable may do so immediately and gives notice as soon as possible afterwards; the right to object then runs from that notice.

Each change to this list is recorded below with its date.

Trembley et Burgermeister SA, operating Filetable Chemin de l'Epinglier 4, 1242 Satigny, Canton of Geneva, Switzerland

Questions about this list, and objections: privacy@filetable.com. A copy of the list as it stood on a given date is available on request.