Sub-processors Directory
Authorized third-party sub-processors utilized by the Mareante platform in compliance with GDPR Article 28 and the Swiss nFADP.
Table of Contents
Notice: Engineering compliance draft for Mareante (not yet reviewed by an independent attorney).
1. Overview and Purpose
Under Article 28 of the General Data Protection Regulation (GDPR) and Article 9 of the Swiss Federal Act on Data Protection (nFADP), Nuno Ribeiro, operating as a Swiss sole proprietorship (Einzelunternehmen) trading as "Mareante" ("Mareante"), maintains this public directory of authorized third-party sub-processors.
A sub-processor is a third-party data processor engaged by Mareante who receives, processes, or stores personal data on behalf of our customers in connection with providing the Mareante autonomous development platform at mareante.nuuno.art.
2. Directory of Authorized Sub-processors
The following third-party entities have been vetted and authorized to process data for the Mareante platform:
| Entity Name | Corporate Seat & Region | Purpose / Scope of Services | Data Processed | International Transfer Safeguards |
|---|---|---|---|---|
| Google Cloud <br>(Google Ireland Limited / Google LLC) | Dublin, Ireland / Mountain View, CA, USA | AI foundation model inference (Google Gemini text models) and live voice audio streaming (FR-VC-01). | Prompt inputs, task specifications, generated code diffs, real-time voice audio streams. | EU-U.S. Data Privacy Framework certification; Swiss-U.S. Data Privacy Framework; European Commission Standard Contractual Clauses (SCCs); Enterprise zero-training commitment. |
| Stripe <br>(Stripe Payments Europe, Ltd. / Stripe, Inc.) | Dublin, Ireland / South San Francisco, CA, USA | Payment processing, subscription lifecycle management, invoicing, tax/VAT compliance, customer portal (FR-BL-01–FR-BL-02). | Customer name, billing address, business VAT ID, subscription status, payment transaction identifiers. (Note: Mareante never handles raw card data). | PCI-DSS Level 1 certified; EU-U.S. Data Privacy Framework; Swiss-U.S. Data Privacy Framework; Standard Contractual Clauses (SCCs). |
| [To be provided by operator: {{HOSTING_PROVIDER}}] | Switzerland / European Union | Cloud infrastructure hosting, managed PostgreSQL database clusters, Docker container compute execution (FR-EX-01). | Multi-tenant database records, encrypted integration secrets, project files, container run outputs, audit logs. | ISO/IEC 27001 certified; SOC 2 Type II; Processing within CH/EU; Data Processing Agreement conforming to GDPR Art. 28 & Swiss nFADP. |
| [To be provided by operator: {{EMAIL_PROVIDER}}] | Switzerland / European Union | Transactional email delivery (account invitations, 2FA verification codes, budget alerts, security breach notices). | Recipient email address, account name, transactional message content. | Data Processing Agreement; TLS 1.3 enforced transmission; strict non-disclosure obligations. |
3. Sub-processor Due Diligence and Standards
Prior to onboarding any sub-processor, Mareante verifies that the vendor:
- Maintains industry-standard security certifications (such as ISO/IEC 27001, SOC 2 Type II, or PCI-DSS);
- Executes a legally binding Data Processing Agreement with terms conforming to GDPR Art. 28 and Swiss nFADP Art. 9;
- Guarantees that customer inputs and project code are not used to train commercial public AI models;
- Employs strong encryption for all data in transit (TLS 1.3) and at rest (AES-256 or ChaCha20);
- Maintains tested business continuity, disaster recovery, and incident response procedures.
4. Sub-processor Changes and Notification Mechanism
4.1. Advance Notification: Mareante will notify registered tenant Owners and Admins of any proposed addition or replacement of an authorized sub-processor at least fourteen (14) calendar days before granting the new sub-processor access to customer personal data. Notifications will be delivered via email to the registered account Owner and posted via an in-app notice.
4.2. Right to Object: Business customers acting as Data Controllers under our DPA have the right to object to the appointment of a new sub-processor on reasonable data protection grounds within fourteen (14) days of receiving notification.
4.3. Resolution of Objections: Upon receiving a timely, written objection with reasonable privacy justification:
- Mareante will consult in good faith with the customer to identify reasonable alternative solutions or technical configurations avoiding processing by the contested sub-processor;
- If no mutually acceptable resolution can be reached within thirty (30) days of the objection, the customer may terminate the affected subscription without penalty and request an export (
FR-AU-04) and erasure (FR-AU-05) of their tenant data.
5. Contact Information
For inquiries regarding this Sub-processors Directory or our vendor assessment practices, contact:
- Operator: Nuno Ribeiro (Mareante)
- Privacy Contact: [To be provided by operator: {{LEGAL_EMAIL}}] (or [To be provided by operator: {{LEGAL_DPO_CONTACT}}])
- General Inquiries: [To be provided by operator: {{LEGAL_EMAIL}}]