Sub-processors
This page lists the third-party sub-processors that TraceHold B.V. ("Tracehold", "we", "us"), formerly Verifia, engages to help deliver the managed Tracehold service (our paid Insight and Governance plans), and the providers used on this website. It supports the transparency commitments in our customer Data Processing Agreement (DPA).
This is the original English version. In case of any discrepancy it prevails over the Spanish courtesy translation.
The free extension has no customer organisation. It sends limited, pseudonymous usage statistics to Tracehold's own servers, hosted by Contabo, as the Privacy Policy describes; apart from the reports you choose to send, it does not send the content of your prompts, messages or files. The lists below apply to the managed service and to this website.
1. Scope & what a sub-processor is
A sub-processor is a third party we engage to process customer data on our behalf in order to provide the managed Tracehold service. Sub-processors process data on our behalf and only to the extent needed to deliver the service.
The managed service is built to minimise what leaves the browser or the endpoint: by default it receives event metadata (type of data, severity, destination, action) plus a masked sample of the value. Prompt text reaches Tracehold only if an optional feature has been switched on for your organisation (the LLM classifier, keeping the content of findings, or file fallbacks); the LLM classifier is the reason OVHcloud appears below. Tracehold's servers are hosted in the European Union.
2. Current sub-processors
These are the sub-processors of the managed service:
| Sub-processor | Purpose | Data | Location | When it applies |
|---|---|---|---|---|
| Contabo GmbH | Hosting of the platform (servers and database), of Tracehold's own mail server and of this website | All data the service processes for you: event data, console accounts, encrypted kept content where enabled, and alert and sign-in emails | European Union | Always, for every managed deployment |
| OVHcloud AI Endpoints (OVHcloud) | AI inference for the optional LLM classifier | The text sent for classification, the recent context of the conversation, older messages sent to be summarised and, where interception is enabled, text extracted from files, in transit. Tracehold does not store it; OVHcloud states publicly that it does not retain the data or use it for training | France, according to OVHcloud | Only if the LLM classifier has been switched on for the organisation (off by default; Governance plan, beta) |
System & transactional email (sign-in, alerts and service notifications) is sent from Tracehold's own mail server, hosted by Contabo in the EU, so no third-party transactional-email provider acts as a sub-processor. We use no third-party error-monitoring service and no analytics provider.
3. Website
These providers concern the visitors of tracehold.com, not data processed for customers:
| Provider | Purpose | Data | Location | When it applies |
|---|---|---|---|---|
| Cloudflare, Inc. | Turnstile, an anti-bot check on the contact form | IP address and browser signals | United States; the transfer relies on the EU-US Data Privacy Framework | On the contact page, when the form is loaded and sent |
| Vercel Inc. | Answers requests to www.tracehold.com and only redirects them to tracehold.com | IP address and the requested address | United States; the transfer relies on the EU-US Data Privacy Framework | When someone visits www.tracehold.com |
The Privacy Policy explains how the contact form works.
4. What is not a sub-processor
The AI tools that your organisation monitors, and the destinations it configures itself, such as a SIEM, Slack or Microsoft Teams, or identity providers (OIDC, LDAP/AD), are not Tracehold sub-processors. They are your own choices, they receive data from your organisation under your own agreements with them, and they are not listed here.
5. Analytics & cookies
We use no website or product analytics: no third-party analytics provider, and no analytics or tracking cookies. The website sets no cookies (the Cloudflare Turnstile frame on the contact page may use a technical local-storage item, see the Privacy Policy). If we ever introduced an analytics provider, it would be added to the tables above and disclosed here before it was enabled.
6. Advance notice of changes
We may add, replace or remove sub-processors as the managed service evolves. When we do, we will update this page and revise the "Last updated" date above. We notify customers of an intended addition or replacement at least 30 days in advance, and they may object during that period.
To be notified of changes, subscribe by emailing privacy@tracehold.com.
7. Contact us
Questions about our sub-processors, data processing or the DPA?
- Privacy enquiries & change notifications: privacy@tracehold.com
- Data protection contact: dpo@tracehold.com
- General: hello@tracehold.com
- Post: TraceHold B.V., Werfkade 25, 1033 TA Amsterdam, Netherlands · Jurisdiction: the Netherlands
Related pages: Security, Privacy, Terms, DPA and Subprocessors.