# Sub-processors

> The services ombra engages to make your practice work: for what, where they process your data and how you hear what changes.
>
> Canonical page: https://ombracare.com/en/subprocessors/

## Who helps us. And where.

ombra uses as few other services as it can. Here you see which, for what and where.

Last updated: 19 October 2026 · [Dutch original](https://ombracare.com/subprocessors/)

## For your clients’ data

This sub-processor processes your clients’ data for ombra. That is annex C of the [data processing agreement](https://ombracare.com/en/dpa/).

| Sub-processor | For what | Where |
| --- | --- | --- |
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Hosting ombra: the app, the database, documents, keys and logs, the malware scan of uploads and secure access (Azure Front Door with a firewall). | Ireland (Microsoft Azure North Europe), with a copy of the database backups in the Netherlands (Microsoft Azure West Europe). Connections arrive at Microsoft’s nearest point of presence. |

Microsoft is part of an American group and may work outside the EU for certain support and security. The safeguards for that transfer are in [article 8 of the data processing agreement](https://ombracare.com/en/dpa/#transfers). How we deal with requests from authorities, you can read under [Security](https://ombracare.com/en/security/#jurisdiction).

## For our own work

We use these services for ombra itself. They receive no records. If someone e-mails us themselves, that message is in our mailbox.

| Service | For what | Where |
| --- | --- | --- |
| Microsoft (Azure Communication Services) | Sign-in codes by e-mail, from account@notify.ombracare.com. No open or click tracking. | Europe |
| Microsoft 365 (Exchange Online) | Our mailboxes: support@, privacy@, security@ and hello@ombracare.com. | European Union |
| Cloudflare | The domain names (DNS) of ombracare.com. Sees no content. | Worldwide |

So never put client data in a mail to us.

## What you connect yourself

If you connect your calendar or mail, you use your own account with Google or Microsoft. These are not sub-processors of ombra: your agreements with that service apply. ombra fetches data from it in your name and sends mail with it.

| Service | What you connect | What ombra may do |
| --- | --- | --- |
| Google | Google Calendar and Gmail | Reading your calendars. With mail access, also reading and sending your mail. |
| Microsoft | Outlook and the Microsoft 365 calendar | Reading your calendars. With mail access, also reading and sending your mail. |

Where those services process your data depends on your account and your subscription. A personal Gmail or Outlook.com account does not automatically offer the same agreements as a business account: check that before you process client data with it. Which data ombra keeps from a connection, you can read in the [privacy statement](https://ombracare.com/en/privacy/#connections).

## When something changes

We e-mail you about a new or different sub-processor at least 30 days before it starts work. You do not need to sign up for anything for this: we e-mail your account’s address. If you have a well-founded reason to object, we look for a solution together. If that does not work, you may cancel free of charge. That is what the [data processing agreement](https://ombracare.com/en/dpa/#sub-processors) says.

## See also

- [Data processing agreement](https://ombracare.com/en/dpa/): How ombra processes your clients’ data: only on your instructions.
- [Security](https://ombracare.com/en/security/): How we protect your records, and how to report a vulnerability.
- [Privacy statement](https://ombracare.com/en/privacy/): What ombra itself does with your data: your account, the website and your messages.

## Be the first to hear when you can start.

Get updates about Ombra and the date of our launch.

[Follow our launch](https://ombracare.com/en/#wachtlijst)