Skip to content
Quadrarium

Sub-processors

Operated by Gaperi Consult SRL, Strada Nicovalei nr. 64, Brașov, Romania · CUI 46640245 · Trade register J8/2526/11.08.2022.

Last updated: 28 Oct 2026

The third parties that process personal data for Quadrarium, what each one does, and where. We update this list before a new sub-processor starts processing personal data.

  • Amazon Web Services (AWS)

    What for
    Hosting: sign-in (Amazon Cognito), the application (AWS Lambda, Amazon API Gateway), the database (Amazon Aurora PostgreSQL), files (Amazon S3), feedback and waitlist entries (Amazon DynamoDB), credentials (AWS Secrets Manager), logs (Amazon CloudWatch) and, in production, request tracing (AWS X-Ray).
    Data
    Everything Quadrarium stores: account, reservation, declaration and subscription data.
    Where
    EU: Frankfurt (eu-central-1).

  • Amazon CloudFront and AWS WAF (AWS)

    What for
    Deliver the site and pass requests to the application. Only the public, content-hashed app files (/assets) are cached at the edge; pages, API responses and personal data never are. In production, the AWS WAF firewall screens requests.
    Data
    Requests in transit, including IP addresses; a short-lived sample of requests for the firewall.
    Where
    AWS’s global edge network: the edge location nearest to the user, which can be outside the EU.

  • Amazon Bedrock (AWS), with Anthropic’s Claude models

    What for
    The optional plain-language explanation of a reconciliation result: it explains the figures, never computes or changes them. We also use it internally to draft rule candidates from official texts, which a person checks before any use.
    Data
    The comune, the period, the totals and the number of stays; no guest data.
    Where
    EU: the EU cross-region inference profile, which AWS documents as keeping requests within the EU. According to AWS, the model provider has no access to prompts or answers.

  • Stripe (Stripe Payments Europe)

    What for
    Payments and subscriptions.
    Data
    Billing details and payment method, entered on Stripe’s checkout; we keep only Stripe’s identifiers.
    Where
    EU (Ireland); Stripe may transfer data outside the EU, including to the United States, under its own safeguards.

  • Plausible Analytics

    What for
    Cookieless website statistics, only when switched on.
    Data
    Visits and product events, counted in aggregate; no cookies and no personal profiles.
    Where
    EU.

  • Cloudflare (email routing)

    What for
    Forwards the messages sent to our email addresses ([email protected] and [email protected]) to our mailbox.
    Data
    Messages you send us: your email address and what you write.
    Where
    Cloudflare’s global network, which can be outside the EU.

Sentry (error tracking) is built into the code but switched off. We will add it to this list before switching it on.