1. The list
These are the providers that OutLine Digital Agency uses to provide Omega Work. They are engaged as processors and bound by contract to obligations equivalent to those of the Data Processing Agreement.
| Provider | Activity | Where it processes data | Outside the EEA |
|---|---|---|---|
| IONOS SE | Servers and storage: hosts the application, the workspace databases, uploaded files and backups. | Germany | No |
| Aruba S.p.A. | Relays the service’s outgoing email: invitations, password resets, notification digests and contracts. Messages contain the recipient’s name and email address, the name of the person who acted, of the workspace and of its teams, the titles of the tasks and projects they mention and, for an invitation, the message its sender typed. | Italy | No |
| Stripe Payments Europe, Limited | Collects subscription payments and issues receipts. It processes only the billing details of the subscriber (company name, address, VAT number, billing email, card details — which never pass through our servers). With them it receives the name of the workspace, the sign-in email address of its owner and our internal reference numbers. It has no access to the data stored in workspaces. | Ireland | No |
No sub-processor processes your workspace data outside the European Economic Area. Stripe, for subscription payment data only, may also use Stripe, Inc. in the United States under the EU-U.S. Data Privacy Framework (see the Privacy Policy).
2. Why the list is so short
Three providers is few for a cloud service: every extra name is one more party that sees customers’ data. The short list is the result of deliberate, verifiable choices:
- no third-party analytics or tracking tools;
- no external content delivery network: images, scripts and fonts are served from our own domain;
- no external support, chat, ticketing or error-reporting service: errors stay in our logs, on our servers;
- no artificial-intelligence provider at platform level;
- no marketing email service: the only email we send is service email (invitations, password resets, notification digests, billing), through a single relay.
3. If this list changes
- The addition or replacement of a sub-processor is announced at least 30 days in advance, by email to the account address and with a notice in the application.
- Within that period the customer may object on reasonable, documented data protection grounds.
- If it objects, we look in good faith for an alternative; if none is practicable, the customer may terminate without penalty with effect from the date of the change.
4. What is NOT on this list, and why
Services you connect yourself. Omega Work lets you send information to other tools: Slack, Microsoft Teams, Discord, Google Chat and Telegram channels, webhooks (for example Zapier, Make or n8n), API connectors, and AI assistants that use your workspace through the API or MCP. These are not our sub-processors: you choose them, the contract is yours, and the data goes there on your instruction. They belong in your own record of processing.
Browser push services. If you turn on browser notifications, your browser’s vendor (for example Google, Apple, Mozilla or Microsoft) delivers them through its own push service. The message is end-to-end encrypted between our server and your browser: the push service carries it but cannot read it. It sees only a device address and the time of delivery.
In the application, under Admin console → Privacy and compliance, each customer finds its record of processing already filled in with what Omega Work processes for it, and this list ready to attach.