Sub-processors — Version history
Every published version, with a line-by-line comparison between any two.
Changes from version 3 to version 4: +9 −2 lines
## 1. About This List {#about}
Lataamo's event application is operated by Lataamo Group Oy (Business ID: 1652310-5), Espoo, Finland. When an event organizer engages us to run their event, the organizer is the data controller and Lataamo Group Oy acts as the data processor.
To provide the platform, we engage the third-party service providers ("sub-processors") listed below. Every sub-processor is bound by a data processing agreement that meets the requirements of GDPR Article 28, and where personal data is transferred outside the EU, an appropriate transfer mechanism is in place.
The third-party service providers ("sub-processors") below are approved to support the platform. Use of each provider depends on the enabled services and configuration. Every sub-processor is bound by a data processing agreement that meets the requirements of GDPR Article 28, and where personal data is transferred outside the EU, an appropriate transfer mechanism is in place.
This list is published with a full version history. We notify controllers before adding or replacing a sub-processor, as agreed in the data processing agreement, and every change to this list is released as a new version with an effective date and a plain-language change summary — see [Section 4](#changes).
## 2. Active Sub-processors {#active}
## 2. Approved Sub-processors {#active}
| Sub-processor | Purpose | Personal data involved | Processing region | Transfer safeguard |
| --- | --- | --- | --- | --- |
| Vercel | Application hosting and delivery | HTTP requests, rendered pages, IP addresses | EU (application runtime); US (DDoS/network protection layer) | EU-US Data Privacy Framework |
| Google Cloud | Core infrastructure: database, authentication, file storage, compute, AI processing (Gemini Enterprise Agent Platform) | All platform data | EU — primary region europe-north1 (Finland)¹ | Not transferred outside the EU¹ |
| Mistral AI | AI processing (fallback provider) | Profile text, messages | EU (France) | No transfer |
| Deepgram | Voice transcription | Audio recordings | EU endpoint | No transfer |
| Soniox | Final transcription of session audio and voice notes | Audio recordings and transcripts | EU project and endpoints for audio/transcripts; see regional limits below | EU Standard Contractual Clauses where restricted transfers occur |
| Resend | Transactional email delivery | Email addresses, notification content | US | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Upstash | Rate limiting (abuse prevention) | Hashed IP addresses, request counts | EU | No transfer |
| Cloudflare | Content delivery network, live video streaming | HTTP metadata, live video streams (transient) | Global edge network; recordings stored in the EU | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| LinkedIn | Optional sign-in (OAuth) — engaged only when a user chooses to sign in with LinkedIn | Name, email, LinkedIn profile ID | US | User-initiated transfer |
| Sentry | Application error and performance monitoring | Technical error reports: stack traces, URLs, browser/OS metadata — personal data scrubbed before send, no IP addresses stored; account and organization metadata | EU (Frankfurt — EU data residency); US (account and organization metadata only) | EU-US Data Privacy Framework + EU Standard Contractual Clauses |
¹ See [Section 3](#ai-regions) for how AI processing regions are governed.
## 3. AI Processing Regions {#ai-regions}
By default, all AI processing runs on EU infrastructure: Google Cloud (Gemini Enterprise Agent Platform) in the EU, and Mistral AI in France as fallback provider. AI model and provider selection is configurable per event; enabling any non-EU endpoint requires explicit acknowledgment by the event organizer and is logged for accountability. Google's Cloud Data Processing Addendum applies to all AI endpoints.
### Soniox
Audio and transcripts are processed and stored using the EU project and EU endpoints, subject to limited security, support, service-operation and legal exceptions. Account, usage and billing metadata may be handled outside the region; EU Standard Contractual Clauses apply where restricted transfers occur. Customer content is not used for model training.
Our integration requests deletion of terminal async transcriptions and separately uploaded files after processing. Async content otherwise expires automatically after 30 days.
## 4. Changes to This List {#changes}
Before adding or replacing a sub-processor, we notify controllers in accordance with the data processing agreement, giving them the opportunity to object.
Each revision of this list is published as a new immutable version with its own effective date and change summary. You can review every change in the [version history](/legal/sub-processors/history) — including a side-by-side comparison of any two versions — and in the [combined changelog](/legal/changelog).
**Questions?** Contact us at [info@lataamo.fi](mailto:info@lataamo.fi)
All versions
Version 5
Effective October 16, 2026
Updated the Mistral AI entry: its purpose is AI processing, and voice-note transcripts are included in the personal data it processes.
Version 4
Effective September 15, 2026
Added Soniox as an approved EU final transcription sub-processor, with regional processing, transfer and retention details.
Version 3
Effective July 13, 2026
Removed Lyyti — registration import is not currently in use; it will be re-listed with prior notice if an event enables it. Simplified the AI processing region description and unified naming.
Version 2
Effective July 2, 2026
Added Sentry (application error monitoring) — error data is hosted in Sentry's EU region (Frankfurt); only account and organization metadata is processed in the US under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Version 1
Effective July 2, 2026
Initial published version — public list of the sub-processors engaged to operate the platform.