LEGAL
Subprocessors
The providers that help us run FileMentra, what each one does, the data it handles and where it processes it.
- Effective
- September 22, 2026
- Last updated
- September 22, 2026
- Provided by
- LUMI TECHOLOGY CORPORATION - FZCO
1. How we choose and bind providers
We use a small number of established providers. Before we use one, we review its security and privacy practices, and we sign written terms that require it to process data only on our instructions, keep it confidential and secure, and delete it when the service ends. Where data leaves the European Economic Area, those terms include the European Commission’s Standard Contractual Clauses or rely on an adequacy decision such as the EU-US Data Privacy Framework. This list forms part of our Data Processing Addendum.
2. Current subprocessors
| Provider | What it does for us | Data | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Encrypted storage of files, previews and exports (Amazon S3); encryption key management (AWS KMS) | Customer content, file metadata | Frankfurt, Germany (EU) |
| DigitalOcean, LLC | Application servers, managed database, cache, background workers and the isolated malware-scanning server | All service data, including account data and customer content in transit through the servers | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | Domain name service, network security, protection against attacks and delivery of web traffic | Network traffic, IP addresses, request metadata | Global network; traffic is handled at the location nearest to the visitor |
| Resend, Inc. | Sending service emails: verification, invitations, sign-in codes, receipts and notifications | Recipient email address, email content | United States |
| Stripe, Inc. and its affiliates | Payment processing, subscriptions, invoices, receipts and fraud prevention | Billing name and address, email, tax ID, payment details (held by Stripe only) | United States and European Union |
| Functional Software, Inc. (Sentry) | Error reporting and performance monitoring, with content and secrets removed | Technical data about errors, pseudonymous identifiers, IP address | Germany (EU data region) |
| Google LLC and Google Ireland Limited (Google Analytics) | Measuring visits to the public website; no customer content and nothing from inside the service | Public pages visited, referring site, browser and device type, approximate location; cookies only with consent where the law requires it | United States and European Union |
| PostHog, Inc. | Counting visits to the public website, without cookies; no customer content and nothing from inside the service | Public pages visited, referring site, browser and device type, country; IP address only as a one-way hash to count unique visitors, not stored | Germany (EU data region) |
Customer files are stored only in Frankfurt. Files are scanned for malware on our own server; no file is sent to a third-party scanning service. We do not use any third-party artificial intelligence service; text recognition for search and redaction runs on our own servers.
3. Services you choose to connect
If you sign in with Google, or connect your organisation’s single sign-on provider, that provider acts independently under its own terms. We receive only your name, email address and an account identifier from it, and send it nothing from your workspace. Our sign-in page loads Google’s sign-in script to offer a one-click “Continue as” prompt, so Google also learns that the page was opened from your browser.
4. Changes
We give customers at least 30 days’ notice before a new subprocessor starts processing customer content, by updating this page and, for workspaces on paid plans, by email to the workspace owner. A customer with a reasonable data protection objection may raise it with us at office@esmb.rs during that period; if we cannot resolve it, the customer may end the affected service and receive a refund of any prepaid, unused fees for it.