Cloud-IAM GDPR sub-processors
How Cloud-IAM provides world-class security for companies and their users
What is GDPR?
The General Data Protection Regulation (GDPR / DSVGO) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was approved by the EU Parliament in April 2016 and came into effect on May 25, 2018.
What are your sub-processors, as defined by the GDPR?
Cloud-IAM uses certain sub-processors to assist it in providing to its customers the Application Services as described in the Master Services Agreement or Terms of Use available at terms-of-service or such other location as the Terms of Use may be posted from time to time (as applicable, the “Agreement”). Defined terms used herein shall have the same meaning as defined in the Agreement.
What is personal data?
GDPR is especially concerned about protecting personal data of individuals. Personal data (Art. 4 GDPR) consists of any information that allows us to identify a person directly or indirectly and can be anything such as a name, email address, credit card number, or documents with personal information.
How we process personal data
When you visit our websites or use our services we will most likely process your personal data in one way or another. You can find all relevant information about which data we process, our legal basis for processing, and your rights regarding your personal data in our privacy policy.
How about sub-processors?
A subprocessor is a third party data processor engaged by Cloud-IAM, including entities from within the Cloud-IAM group, who has or potentially will have access to or process Customer Content (which may contain Personal Data). Cloud-IAM engages different types of subprocessors to perform various functions, as explained in the tables below. The service has two places where that data lives, with different sub-processors, so they are listed separately: your Cloud-IAM deployment (the data plane) and the Cloud-IAM platform (the control plane). The detail of each processing, retention periods included, is in the data processing agreement.
Your Cloud-IAM deployment (data plane)
Your end users' personal data (realm users, credentials, sessions) lives in your deployment and its backups. Each deployment runs at one of the providers below, chosen when you create it.
Hosting: one of these providers per deployment
For every deployment, regardless of the hosting provider chosen
Backups. Encrypted database dumps stored outside the deployment, in at least one of the two locations below; both are used by default. The choice is set per deployment and shown in its backup settings.
On request, Cloud-IAM can also add a backup location it manages at another provider, for example AWS storage for a deployment hosted at AWS; that provider is then a sub-processor for the deployment's backups.
Cloud-IAM platform (control plane)
The console and the REST API hold your account data: console users, contacts, billing, support conversations, deployment names and settings. The processors below handle that data for Cloud-IAM. None of them accesses the end-user data held in your deployments.
Last updated: 21 October 2026.
Always in control
As a European SaaS we can provide the highest degree of GDPR compliance. We rely on best-in-class global companies to provide our customers with the best possible confidentiality, integrity and availability. We understand that you might not want to rely on our or our sub-processors' controls and measures to safely handle personal data of you and your customers. We provide high-quality services, including access to our support, without accessing your data.
Guaranteed compliance with GDPR
A deployment hosted in the European Union involves no transfer of personal data outside the EU. What leaves a deployment is its logs and metrics, and its backups generated for disaster recovery; both are kept in France, as listed above. Every Cloud-IAM operator or consultant who may access your deployment is located in the EU. Inactive customer accounts on the platform are reviewed and deleted after six months of inactivity.
You are the controller of the users in your deployment: the lawful basis, the retention and the transfers you decide on are yours to document. Cloud-IAM acts as your processor, and the data processing agreement sets out what we do with that data.
