Sub-processors
Last updated: 12 November 2026
widdix GmbH engages the following sub-processors to provide attachmentAV. The list corresponds to Annex IV of the attachmentAV Data Processing Agreement; the section reference in the table refers to that agreement.
| Name | Address | Contact | Description of the processing (subject matter, nature, duration) | Location | Transfer mechanism (where applicable) |
|---|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | aws-EU-privacy@amazon.com | Hosting and infrastructure for the Products (compute, transient storage, databases, backups), including email delivery (Amazon SES) and monitoring and logging (Amazon CloudWatch); for the duration of the processing | EU: eu-west-1 (Ireland) – default. At Customer’s choice: United States: us-east-1 (N. Virginia); Canada: ca-central-1; India: ap-south-1 (Mumbai); Australia: ap-southeast-2 (Sydney) | EU region: no transfer (AWS GDPR DPA). Other regions, on Customer’s instruction (Part 3, Section 3.7(a)): United States – EU-U.S. Data Privacy Framework; Canada – Commission adequacy decision 2002/2/EC; India and Australia – SCCs (Module 3) under the AWS GDPR DPA |
| Sophos | Sophos Ltd., The Pentagon, Abingdon Science Park, Abingdon OX14 3YP, United Kingdom | privacy@sophos.com | Anti-malware engine and signature updates operated on the processor’s infrastructure; hash-based reputation lookup (cryptographic file hash only, no file content, no customer identifiers) at the time of each scan | Latency-based routing to Sophos endpoints in the United States, Ireland, Germany, India, Japan or Australia; not selectable by the processor | Sophos Data Processing Addendum incl. SCCs (Module 3), UK Addendum and Swiss amendments; only cryptographic file hashes are transmitted |
| Google Workspace | Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | Data Protection Team, as set out in the Google Cloud Data Processing Addendum (cloud.google.com/terms/data-processing-addendum) | Support communication by email, which may include scan metadata provided by the controller | EU and other locations as set out in the Google Cloud Data Processing Addendum | Google Cloud Data Processing Addendum incl. SCCs; EU-U.S. Data Privacy Framework |