Sub-processors
This page lists the third-party sub-processors that Tracehold B.V. ("Tracehold", "we", "us"), formerly Verifia, engages to help deliver the managed Tracehold service — our paid Insight and Governance plans. It supports the transparency commitments in our customer Data Processing Agreement (DPA).
1. Scope & what a sub-processor is
A sub-processor is a third party we engage to process customer data on our behalf in order to provide the managed Tracehold service. Sub-processors act on our documented instructions, under contract, and only to the extent needed to deliver the service.
Consistent with our design, the managed service is built to minimise what leaves the device: detection runs on the device and, by default, only metadata — the type of finding, its severity and a timestamp — reaches the backend. The prompt itself — your sensitive content — does not leave the browser by default. Tracehold is built and hosted in the European Union, in France, with EU data residency; organisations that prefer it can self-host the entire stack, in which case no data reaches our infrastructure and these sub-processors do not apply.
2. Current sub-processors
We engage a small number of vetted infrastructure sub-processors to run the managed service. Each operates within the European Union, under a written contract imposing data-protection obligations no less protective than those in our DPA, and only to the extent needed to provide the service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo | Infrastructure hosting (compute, storage and database for the managed service) | European Union (France) |
| OVH | Infrastructure hosting (compute, storage and database for the managed service) | European Union (France) |
System & transactional email (sign-in, alerts and service notifications) is sent from Tracehold's own self-hosted mail infrastructure in the EU, so no third-party transactional-email provider acts as a sub-processor. We use no third-party error-monitoring service and no analytics provider.
3. Analytics
We use no website or product analytics: no third-party analytics provider, and no analytics or tracking cookies. If we ever introduced one, it would be added to the table above and disclosed here before it was enabled.
4. Advance notice of changes
We may add, replace or remove sub-processors as the managed service evolves. When we do, we will update this page and revise the "Last updated" date above. In line with our customer DPA, we offer advance notice of material changes to this list so customers have the opportunity to review them.
To receive advance notice of changes, subscribe by emailing privacy@tracehold.com.
5. Contact us
Questions about our sub-processors, data processing or the DPA?
- Privacy enquiries & change notifications: privacy@tracehold.com
- Data Protection Officer: dpo@tracehold.com
- General: hello@tracehold.com
- Post: Tracehold B.V., Werfkade 25, 1033 TA Amsterdam, Netherlands · Jurisdiction: the Netherlands
Tracehold is built and hosted in the European Union, in France, on Contabo and OVH infrastructure, with EU data residency and an optional full self-host. See our Security and Privacy Terms DPA Subprocessors pages for more.