Legal
Sub-processor list
This is the maintained list of sub-processors engaged by Cecur Limited to process personal data on behalf of customers of the Cecur portal at cecur.io, referred to by Annex 1 of the Cecur data processing agreement.
CecurSign publishes its own list for processing inside that product.
Last updated: 26 August 2026
1. How we notify changes
We will update this page and email the account owner of each customer at least 14 days before adding or replacing a sub-processor. Objection rights are set out in clause 6 of the data processing agreement.
2. Internal services, which are not sub-processors
The following are operated by Cecur Limited itself and are not third parties: the Cecur products (including CecurSign), the Cecur notification service (message dispatch) and DocVault (document storage).
3. Sub-processors
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| Auth0 (Okta, Inc.) | Identity and authentication for customers’ authorised users | Names, email addresses, credentials, MFA enrolment, authentication events. | Not yet confirmed. We make no claim about where authentication data is held. |
| Resend (Resend, Inc.) | Transactional email delivery (invitations, verification, invoices, support replies) | Names, email addresses, email content. | United States. |
| OVHcloud | Managed PostgreSQL database hosting | All portal data. | European Union. |
Our application servers and the databases behind them are hosted in the European Union. The company that provides that hosting is not yet named above, so this list is not yet complete on that one point, and we will add it when we can name it.
4. Listed for transparency, not sub-processors
- Stripe Payments Europe, Ltd / Stripe, Inc.: payment processing; Cecur acts as controller for billing, and Stripe is an independent controller for its own fraud and compliance processing.
- European Commission VIES service: VAT number validation; a public EU service, not a commercial processor.