Cloud-IAM GDPR sub-processor
How Cloud-IAM provides world-class security for companies and their users
What is GDPR?
The General Data Protection Regulation (GDPR / DSVGO) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was approved by the EU Parliament in April 2016 and came into effect on May 25, 2018.
What are your sub-processors, as defined by the GDPR?
Cloud-IAM uses certain sub-processors to assist it in providing to its customers the Application Services as described in the Master Services Agreement or Terms of Use available at terms-of-service or such other location as the Terms of Use may be posted from time to time (as applicable, the “Agreement”). Defined terms used herein shall have the same meaning as defined in the Agreement.
What is personal data?
GDPR is especially concerned about protecting personal data of individuals. Personal data (Art. 4 GDPR) consists of any information that allows us to identify a person directly or indirectly and can be anything such as a name, email address, credit card number, or documents with personal information.
How we process personal data
When you visit our websites or use our services we will most likely process your personal data in one way or another. You can find all relevant information about which data we process, our legal basis for processing, and your rights regarding your personal data in our privacy policy.
How about sub-processors?
A subprocessor is a third party data processor engaged by Cloud-IAM, including entities from within the Cloud-IAM group, who has or potentially will have access to or process Customer Content (which may contain Personal Data). Cloud-IAM engages different types of subprocessors to perform various functions, as explained in the tables below.
Cloud-IAM use the following sub-processors to provide Cloud-IAM's customer's cloud infrastructure environment and storage for Cloud-IAM's Keycloak Clusters. Personal data of Cloud-IAM's customer customer will only be stored there:
Processing of Cloud-IAM's Customer Content. Cloud-IAM works with various subprocessors that monitor, maintain and otherwise support the Cloud-IAM control-plane (Cloud-IAM's dashboard and Cloud-IAM's REST API). In order to provide this functionality, these subprocessors may, but not necessarily will, have access to Cloud-IAM's Customer Content but never Cloud-IAM's customer's customer content.
Effective date: 12 October 2026. This list applies to new Cloud-IAM customers from that date, and to existing customers who have not received notice of a different effective date. Changes on 12 October 2026: Resend replaces Brevo for transactional email; Netlify and Sentry are no longer used; Microsoft 365 is added; Slack and Zapier are added, since billing events are forwarded from Stripe to Slack; G Suite is listed under its current name, Google Workspace.
Always in control
As a French SaaS we can provide the highest degree of GDPR compliance. We rely on best-in-class global companies to provide our customers with the best possible confidentiality, integrity and availability. We understand that you might not want to rely on our or our sub-processor's controls and measures to safely handle personal data of you and your customers. We can provide high-quality, that include access to our support services without accessing your data.
Guaranteed compliance with GDPR
We have batched analyzing last date of connection and activity from our customers, as well as batch deletion after 6 month of inactivity.
There are no data transfers between your deployment outside UE (I assumed your deployment will be in UE). The only data transfers that exists with our customer deployment are the cold backup we generate for disaster recovery and they are stored in a French datacenter. Furthermore, all our operatives and consultants that might access your deployment are UE located.
Cloud-IAM does not manage these users for GDPR. Regarding your own user database (i.e., your deployment), you must establish the required processes to comply with GDPR yourself and declare all data transfers that you handle independently. In this case, Cloud-IAM acts as a subprocessor, and our DPA specifies what we do.
