HelpDash — subprocessors
Version 1.0 · Effective from 06-10-2026 · Approved by BJS on 05-10-2026 (#80271)
Annex III to the HelpDash Data Processing Agreement (https://helpdash.eu/dpa). Checked against the running system and the code on 05-10-2026. Not legal advice; no lawyer has reviewed this text. Published in English.
---
Why this list matters
Every other We make AI work product is a data controller for its own users. HelpDash stores other companies' customers' personal data on their behalf, which makes We make AI work s.r.o. a processor under Article 28 GDPR. You, our customer, are the controller; everyone below is a subprocessor.
You can object to a new subprocessor before it starts processing (see "Changing this list").
---
The list
| Supplier | What it processes | Entity / jurisdiction | Region | Ownership | Contract |
|---|---|---|---|---|---|
| Scaleway SAS | Application hosting (Serverless Containers); the database (tickets, messages, requesters, agents); Object Storage for attachments, for the raw inbound email our mail server receives, and for database backup copies; the virtual machine of our own inbound mail server mx1.wemakeai.work | France 🇫🇷 | fr-par (Paris) | Iliad group (FR) | Scaleway's Data Processing Agreement, part of its service contract |
| Scaleway Transactional Email (TEM) | Outbound email: sign-in links, replies to your requesters, notifications — addresses, subjects, message bodies | France 🇫🇷 | fr-par | Iliad group (FR) | Same contract as above |
| Scaleway Cockpit | Operational logs and metrics, kept 30 days. No ticket bodies, no email addresses — see the note below | France 🇫🇷 | fr-par | Iliad group (FR) | Same contract as above |
| BunnyWay d.o.o. (bunny.net) | DNS for helpdash.eu and the CDN in front of the application: every request passes through it and is decrypted at its edge (TLS terminates there), so it handles whatever a request carries — including ticket content in transit. It stores nothing of it beyond its own short edge logs. | Slovenia 🇸🇮 | EU edge locations only (the pull zone's US, Asia, South-America and Africa zones are off) | BunnyWay d.o.o. (SI) | bunny.net's terms of service |
That is the whole list, and the shortness is the point. Two EU-owned suppliers — Scaleway (hosting, database, storage, mail, logs; Paris) and Bunny (the edge; EU locations only) — rather than a hosting provider in one country, a database in another, a mail provider in a third and an error tracker in a fourth.
Inbound email is received by our own mail server (mx1.wemakeai.work), which we operate on a Scaleway virtual machine in Paris; it is not a further supplier.
Not on the list, deliberately
- AI providers. HelpDash has no AI features; no ticket, message or address is sent to an AI provider. A
provider that would process your data is a new subprocessor: it is added here and you are told first.
- Google Workspace carries We make AI work's own team mail (alarm mails, our own correspondence). It does
not process your support data and is not a subprocessor of this service. Alarm mails carry error keys and counts, never ticket content or addresses.
- Error tracking and analytics. HelpDash runs neither; errors are recorded in its own database (redacted) and
logs in Scaleway Cockpit.
The logging note, because it is load-bearing
In a ticket system the message body, the subject and the requester's email address are personal data. The logger redacts by key and by shape at the boundary rather than trusting call sites (src/lib/logger.ts), and there are tests asserting that a real connection failure leaks no credential (#80220) and that no message body reaches an audit entry.
So the monitoring supplier processes identifiers, counts and timings — never content. That is what makes it honest to describe Cockpit's row the way it is described above.
---
What you can rely on
- Data residency: Paris, France. A named region, verifiable from the supplier's own documentation. Database
backup copies are also held by us, outside Scaleway (DPA §9).
- EU ownership, not just EU hosting. A US-owned provider remains reachable under the US CLOUD Act even when
hosting in the EU. For a product whose proposition is that other companies' data is safe with us, the ownership test is the one that matters.
- Isolation between tenants, enforced by the database and proven by tests that have been seen to fail
(#80036, #80037, #80163).
- Notice before a new subprocessor starts processing, with 30 days to object (DPA §5).
---
Changing this list
1. The supplier is checked before adoption for region, jurisdiction and ownership — recorded separately, because they fail independently. 2. It is added here, and to the HelpDash privacy policy's processor section, in the same release. 3. You are notified before processing begins, with 30 days to object. 4. An existing supplier's role is never quietly widened: "we already use Scaleway" is not authority to start sending them a category of data they did not previously receive.