Trust and compliance · Version 2026-07-27
Who helps us deliver Verbrio, what they handle, and what may change.
A subprocessor is a supplier that Verbrio engages to process customer personal data while Verbrio acts as the customer’s processor. We remain responsible for selecting, contracting, and overseeing those suppliers as required by our DPA.
Not every company named here has the same role. Customer-selected integrations and engineering tools are separated from production subprocessors so their status is clear.
These providers support the service today. We limit the data shared with each provider to what the relevant function requires.
The listed legal entities of these providers are established in the EU. That alone does not mean every processing operation stays in the EU; see each provider’s processing location.
Provider
Provider
Provider
Provider
The listed legal entities of these providers are established outside the EU. Where their use involves a restricted transfer, Verbrio relies on the applicable safeguards described below.
Provider
Provider
Provider
Examples: Refurbed, Back Market, WeFact
Refurbed, Back Market, WeFact, and similar connected services are enabled and controlled by the customer under the customer’s own agreement with that service. They are therefore not automatically Verbrio subprocessors.
Verbrio processes data imported from or sent to those services on the customer’s instructions. The customer is responsible for choosing the integration, configuring access, and having a lawful basis for the exchange.
Tools: Cursor, OpenAI Codex, Anthropic Claude Code
Our engineers use Cursor, OpenAI Codex, and Anthropic Claude Code to help write and review code. We do not classify them as production subprocessors because our policy prohibits intentionally submitting production customer data, credentials, or secrets to these tools.
We use contracted business or privacy modes intended to prevent model training on submitted content and to minimize retention. We only describe a tool as having zero data retention when that protection is expressly supported and enabled for the account in use.
If we intend to let an engineering tool process production customer data, we will first assess it, contract it as required, and add it to the current subprocessor list before that use begins.
This is a non-binding direction of travel, not a notice that a migration has happened.
We are evaluating Bunny.net as a possible replacement for Cloudflare. Cloudflare remains the current provider until a migration is completed and announced.
We are investigating Wero and the payment service provider required for a possible future payment stack. Polar remains the current billing and merchant-of-record provider until a completed migration is announced.
We prefer processing in the European Economic Area. Where a provider processes data outside it, we require an applicable adequacy decision or contractual safeguards such as the European Commission’s standard contractual clauses, plus supplementary measures where the assessment requires them.
Processing locations can change within a provider’s contracted service. Material changes to the production subprocessor chain are handled through the notice process below.
We keep this page current and, under our DPA, give customers at least 30 days’ advance email notice before authorizing a new production subprocessor or replacing one, unless urgent security or legal circumstances make advance notice impossible.
A customer may object during that period on reasonable data-protection grounds. We will review the concern in good faith and seek a reasonable alternative; if none is available, either party may end the affected service as described in the DPA.
Contact Verbrio B.V. at the address below. Include your organization name, the affected provider, and the data-protection reason for an objection.
Verbrio B.V.Get Started
Bring your orders, invoices, documents, and marketplace work together. Set up your workspace in under a minute and get started right away.
First month free
Then month-to-month