Subprocessor List
Third-party providers used by Evernow GmbH to provide docket.
Last updated: October 21, 2026
Subprocessors
"Processing location" is where the data is stored or computed. This is separate from where a provider is legally established: a provider headquartered outside the EEA can still process data on infrastructure located in the EEA, but personal data may still be accessible from, or subject to the laws of, that provider's home jurisdiction. Where a provider is established outside the EEA, the table below states the transfer safeguard we rely on for that provider — see International Data Transfers below.
| Provider | Purpose | Processing Location | Legal Entity & Transfer Safeguard |
|---|---|---|---|
| Fly.io | Application hosting and infrastructure, including the database (Fly.io Managed Postgres) and its backups | Frankfurt, Germany, according to current configuration | Fly.io, Inc. (United States). EU-U.S. Data Privacy Framework. |
| Amazon Web Services (S3) | Storage of uploaded files and attachments | Frankfurt, Germany, according to current bucket configuration | Amazon Web Services, Inc. (United States). EU-U.S. Data Privacy Framework and Standard Contractual Clauses. |
| Redis Cloud | Background job queue, real-time updates, caching, and rate limiting | Frankfurt, Germany (AWS eu-central-1) | Redis Inc., San Francisco, United States (redis.io). Data stored in the EU; access from the United States under Standard Contractual Clauses. |
| Stripe | Billing, payment processing, subscription administration, fraud prevention | EU / United States / global processing depending on Stripe services and legal role | Stripe Payments Europe, Ltd (Ireland, EU) as EU contracting entity; processing may also involve Stripe, Inc. (United States). EU-U.S. Data Privacy Framework. |
| Postmark | Transactional email delivery and receipt of replies to notification emails | United States / global processing | AC PM LLC / ActiveCampaign (United States). EU-U.S. Data Privacy Framework; DPA with Standard Contractual Clauses available. |
| AppSignal | Monitoring, application logs (including IP addresses), and error tracking on the server and in the browser | EU | AppSignal B.V. ('s-Hertogenbosch, Netherlands, EU). No international transfer. |
| Cloudflare | Domain management (DNS) and the routing and protection of all requests to docket.rocks and the application (reverse proxy with TLS, defence against attacks and overload, caching of public files) | Global network; a request is processed in the data centre close to the person making it | Cloudflare, Inc. (United States). EU-U.S. Data Privacy Framework and Standard Contractual Clauses. |
Integrations You Connect
docket can exchange data with services that customers or their users use themselves. These are not subprocessors of Evernow GmbH: the customer chooses them, uses them under its own agreement with the provider, and sets them up manually. Nothing is sent to them unless the workspace has been connected.
| Service | What is exchanged | Requires |
|---|---|---|
| Atlassian Jira Cloud | Issues of linked projects and time logged on them are read from Jira; time entries that connected users book on Jira tickets are written to Jira under their Atlassian account. Atlassian account IDs stored in docket are checked against Atlassian to delete data of closed accounts (Evernow GmbH's own processing as controller, see Privacy Policy section 7.11). | An administrator connects the Jira site and links projects; each user connects their own Atlassian account. |
| Tempo Timesheets | Time entries on Jira tickets are read from and written to Tempo instead of Jira's own worklogs. | An administrator chooses Tempo for the Jira connection and enters a Tempo API token. |
| AI apps a user connects (e.g. Claude, ChatGPT, Cursor) via the Model Context Protocol | On the user's requests, the app reads what that user can see in docket and can book, change and delete the user's own time entries. Its provider processes what it reads. | An administrator allows AI connections for the workspace; each user connects an app and confirms on docket's consent page. |
International Data Transfers
Several subprocessors are headquartered outside the European Economic Area, even where the specific infrastructure we use is located within the EEA (see table above). Where this applies, we rely on the transfer safeguard indicated for that provider, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, consistent with Section 11 of the Privacy Policy and Section 20 of the Data Processing Agreement.
Subprocessor Changes
We may update this list from time to time.
For material additions or replacements of subprocessors, we will provide notice by publishing an updated list and by email to account administrators. Where reasonably practicable, notice will be provided at least 30 days before the new subprocessor processes Customer Personal Data.
Customers may object in text form within the notice period; without an objection, the new subprocessor is deemed approved. Where an objection cannot be resolved, the customer may terminate the contract before the new subprocessor is engaged for its data (DPA, section 14).
Contact
Questions regarding subprocessors may be sent to: [email protected].