Sub-processors

Last Updated: 27 October 2026

This page lists the sub-processors authorised by InnoCraft Ltd. (“Matomo”) to process Customer Data in connection with the provision of the Matomo Cloud Services. These sub-processors support the operation and maintenance of Matomo Cloud instances and their backups. The engagement of each sub-processor is governed by the Matomo Cloud Data Processing Agreement (DPA), which forms part of the Matomo Cloud Terms of Service.

Sub-processor	Purpose of processing	Lawful basis	Data location and security	Personal data	Privacy terms
Amazon Web Services EMEA SARL, Luxembourg	Secure infrastructure for servers and databases and logs.	Contract	Europe: – Frankfurt, Germany; – backups stored in Dublin, Ireland	Account and Customer Personal Data, Activity Data	Processing covered by DPA (Data Processing Agreement) While EU data is processed in the EU, we confirm that AWS US is part of the EU-US Data Privacy Framework.
Oblivion Cloud Control B.V (part of Xebia Group B.V)	AWS solution provider: secure infrastructure management IT consulting services, support services	Contract	The Netherlands	Account Data, Customer Personal Data, Activity Data	Processing covered by DPA (available on request)
Amazon Web Services EMEA SARL, Luxembourg	Secure CDN (Content Delivery Network) to store and deliver JavaScript files. This service is provided by AWS Europe. The use of the CDN feature is optional and can be disabled.	Legitimate interest (fraud prevention and information security)	Worldwide; Visitors are sent to a server closest to their region (traffic from the EU stays in the EU).	Request Data (IP address, browser type, operating system, the URL)	Processing covered by DPA (Data Processing Agreement) While EU data is processed in the EU, we confirm that AWS US is part of the EU-US Data Privacy Framework.
Tideways GmbH	Application Performance Monitoring (APM)	Contract (improved observability, performance issue detection, and troubleshooting for Matomo Cloud)	Germany	Processes technical metadata which in rare cases of error logs could include pseudonymised personal data.	Processing covered by DPA (available on request)
Amazon Web Services EMEA SARL, Luxembourg – Amazon Bedrock	Amazon Web Services EMEA SARL, Luxembourg – Amazon Bedrock Optional Ask Matomo AI feature: Processing user prompts and relevant Matomo Instance data to generate AI-assisted responses to user queries. Data is sent to Amazon Bedrock only when Ask Matomo is enabled for the Matomo Cloud instance and a user interacts with the feature.	Contract	The current AI model uses global cross-region inference, meaning Customer Data may be processed in AWS Regions outside the EU/EEA. Where supported, Amazon Bedrock will be configured to use approved EU AWS Regions and EU inference profiles only.	User prompts, tool responses, relevant conversation history and Matomo data needed to answer the user’s query, potentially including personal data in URLs, page titles, report labels or other analytics data. Ask Matomo cannot access raw tracking data or individual visitor-level records.	Processing covered by DPA. AI models are hosted and operated within Amazon Bedrock. Customer Data is not shared with third-party AI model providers.