Last Updated: 9 October 2025
This page lists the sub-processors authorised by InnoCraft Ltd. (“Matomo”) to process Customer Data in connection with the provision of the Matomo Cloud Services. These sub-processors support the operation and maintenance of Matomo Cloud instances and their backups. The engagement of each sub-processor is governed by the Matomo Cloud Data Processing Agreement (DPA), which forms part of the Matomo Cloud Terms of Service.
| Sub-processor | Purpose of processing | Lawful basis | Data location and security | Personal data | Privacy terms |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Secure infrastructure for servers and databases and logs. | Contract | Europe: – Frankfurt, Germany; – backups stored in Dublin, Ireland | Account and Customer Personal Data, Activity Data | Processing covered by DPA (Data Processing Agreement) While EU data is processed in the EU, we confirm that AWS US is part of the EU-US Data Privacy Framework. |
| Oblivion Cloud Control B.V (part of Xebia Group B.V) | AWS solution provider: secure infrastructure management IT consulting services, support services | Contract | The Netherlands | Account Data, Customer Personal Data, Activity Data | Processing covered by DPA (available on request) |
| Amazon Web Services EMEA SARL, Luxembourg | Secure CDN (Content Delivery Network) to store and deliver JavaScript files. This service is provided by AWS Europe. The use of the CDN feature is optional and can be disabled. | Legitimate interest (fraud prevention and information security) | Worldwide; Visitors are sent to a server closest to their region (traffic from the EU stays in the EU). | Request Data (IP address, browser type, operating system, the URL) | Processing covered by DPA (Data Processing Agreement) While EU data is processed in the EU, we confirm that AWS US is part of the EU-US Data Privacy Framework. |
| Tideways GmbH | Application Performance Monitoring (APM) | Contract (improved observability, performance issue detection, and troubleshooting for Matomo Cloud) | Germany | Processes technical metadata which in rare cases of error logs could include pseudonymised personal data. | Processing covered by DPA (available on request) |