> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://mesma.crisp.help/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Mesma Software Sub-Processors

## **Our Sub-Processors and GDPR Compliance**

As a responsible SaaS provider, we take the security and privacy of your data seriously. In delivering our services, we use a number of trusted third-party providers (sub-processors) to ensure reliability, scalability, and advanced functionality. These sub-processors process personal data **only on our instructions and in compliance with GDPR requirements**.

### **Sub-Processors We Use**

Our current key sub-processors include:

* **Microsoft Azure** – Hosts and manages the infrastructure for our SaaS platform. Azure provides high-level security, encryption, and compliance certifications.
* **Microsoft OpenAI** – Powers AI-driven features within our platform, processing data solely in line with customer instructions.
* **Auth0** – Manages authentication and user identity securely, including login credentials and access tokens.
* **Crisp** – Provides live chat and customer support functionality. Personal data processed by Crisp is limited to your communications with support agents.
* **SendGrid** – Facilitates email notifications and transactional messaging. Personal data processed includes email addresses and message content necessary for service delivery.

All of these sub-processors act **strictly as processors** on our behalf, meaning they do not determine the purpose or means of processing your data; we control how and why data is processed.

### **How We Manage Sub-Processors**

To ensure GDPR compliance, we have implemented the following processes:

1. **Formal Sub-Processor List:**
We maintain a current list of all sub-processors (as above), including their role and the types of personal data they process. This list is available to our customers on request.

2. **Notification and Objection Process:**
We notify our customers in advance of any additions or changes to sub-processors. Customers have the right to object to new sub-processors, and in such cases, we work collaboratively to find a compliant solution.

3. **Contractual Obligations:**
Each sub-processor is bound by a **Data Processing Agreement (DPA)**, ensuring they:
* Process data only on our instructions
* Maintain appropriate technical and organizational measures
* Assist us in fulfilling data subject rights and GDPR obligations
* Return or delete data at the end of their engagement

4. **Security and Compliance:**
All sub-processors we use are selected for their robust security practices, GDPR compliance, and international standards certifications where applicable.

### **Why This Matters**
By carefully selecting and monitoring our sub-processors, we ensure that your data is processed securely, lawfully, and transparently. This approach not only meets **GDPR Article 28 requirements** but also ensures reliability and trust in the services we provide.


Last Updated January 2026