Sub-processors
Last updated: 24 August 2026
BookOS engages the third-party sub-processors listed below to deliver the Service. Each sub-processor is bound by a data-processing agreement no less protective than the BookOS Data Processing Agreement. We give registered billing contacts at least 30 days’ prior notice of any addition or replacement.
| Sub-processor | Role | Category | Location | Transfer mechanism | DPA |
|---|---|---|---|---|---|
Microsoft Ireland Operations Limited (Azure) Running the BookOS application (Azure Container Apps), the primary relational database (Azure Database for PostgreSQL Flexible Server), and tenant uploads such as logos, gallery and product photos (Azure Blob Storage). | Hosting, database & object storage | Essential | EU (Azure North Europe, Ireland) | Data stored and processed in the EU; Microsoft Products and Services DPA including EU SCCs for any support-related access from outside the EEA | View |
Stripe Payments Europe, Ltd. Card processing for end customers via Stripe Connect; BookOS subscription billing. | Payments & subscription billing | Essential | EU (Ireland) / US | EU SCCs + Data Privacy Framework | View |
Resend, Inc. Sending booking confirmations, reminders, password resets, and marketing campaigns. | Transactional & marketing email | Essential | EU / US | EU SCCs | View |
ONLINECITY.IO ApS (GatewayAPI) Sending appointment, reminder, and verification SMS when SMS notifications are enabled. | SMS delivery | Optional | EU (Denmark) / carrier networks | EU processing; carrier-required transfers where applicable | View |
Upstash, Inc. Idempotency keys, rate-limiting, lightweight caching. | Redis cache & rate-limiting | Essential | EU (eu-west-1) | EU-resident; no transfer outside EEA | View |
Microsoft Ireland Operations Limited (Azure AI Translator) Translating a salon's own website and admin content between languages when the salon requests a translation. | Machine translation (optional) | Optional | Global endpoint (api.cognitive.microsofttranslator.com) | Microsoft Products and Services DPA including EU SCCs; the Translator resource uses the global endpoint, so submitted text may be processed outside the EEA | View |
Google Ireland Ltd. Two-way calendar sync, only when a salon connects a Google account. | Google Calendar (optional) | Optional | EU / US | EU SCCs + Data Privacy Framework | View |
Meta Platforms Ireland Limited Reading recent media for a salon that connects an Instagram Business or Creator account. | Instagram content feed (optional) | Optional | EU / US | EU SCCs + applicable Meta transfer addenda | View |
Cloudflare, Inc. Assessing signup requests for automated abuse when Turnstile is enabled. | Turnstile bot protection (optional) | Optional | Global edge network | EU SCCs + Data Privacy Framework | View |
Trustpilot A/S Displaying the configured Trustpilot profile and review widget after visitor consent. | TrustBox review widget (optional) | Optional | EU (Denmark) / approved sub-processors | EU processing; SCCs for restricted transfers | View |
Tucows Inc. (OpenSRS) Registering, renewing, and configuring DNS for a domain when a salon purchases managed domain registration. | Domain registration and DNS | Optional | Canada / applicable global domain registries | EU adequacy decision for Canada; registry-required transfers and safeguards where applicable | View |
Sentry (Functional Software, Inc.) Capturing application errors and performance metrics for diagnostics. | Error tracking | Essential | EU (data residency) | EU-resident option enabled; EU SCCs where US transfer occurs | View |
Essential sub-processors are engaged for every customer and are required for the Service to function. Optional sub-processors are only engaged when a customer enables the relevant feature (for example, GatewayAPI is engaged only when SMS notifications are turned on; Google Ireland only when a salon connects a Google Calendar; OpenSRS only when a salon purchases managed domain registration; Azure AI Translator only when a salon requests a translation of its own content).
Changes to this list
We update this page whenever a sub-processor is added, replaced, or removed. Customers on paid plans may subscribe to change notifications via the billing dashboard, or by emailing admin@bookos.dk.
Changelog
- 2026-08-24 — Corrected the hosting, database and object-storage entries to name Microsoft Ireland Operations Limited (Azure). The register previously listed Vercel Inc. and Neon, Inc.; the Service has run on Azure Container Apps, Azure Database for PostgreSQL and Azure Blob Storage in Azure North Europe, and those entries were left over from an earlier deployment. The Service carried no customer tenants during that period, so no salon or end-customer data was processed by either provider. Added Azure AI Translator (Optional), which was in use but undeclared.
- 2026-07-27 — Removed Twilio Ireland Limited; GatewayAPI is the sole optional SMS delivery provider.
- 2026-07-27 — Added Tucows Inc. / OpenSRS (Optional, managed domain registration and DNS).
- 2026-06-03 — Added Twilio Ireland Limited (Optional, SMS delivery). Added Essential / Optional categorisation column.
- 2026-04-28 — Initial sub-processor register published.
Objecting to a new sub-processor
If you object to a newly announced sub-processor on reasonable data-protection grounds, write to admin@bookos.dk within 30 days of the announcement. If the objection cannot be resolved, you may terminate the affected Service component for the remainder of the billing period with a pro-rated refund of unused prepaid fees.