Sub-processors
Overview of sub-processors that process personal data on behalf of Fastpath AS.
This English version is a translation provided for convenience. The Norwegian version is the authoritative text; if the two differ, the Norwegian text prevails.
The list is in three parts: infrastructure for Waysayer, fastpath.no and selected marketing and informational pages about Waysayer, and the tools for support, consulting work and Fastpath’s own business. It is the list referred to in Fastpath’s data processing agreement. Fastpath also uses Waysayer in its own business, so the platform list applies to us in the same way as it applies to customers.
Waysayer
The infrastructure the platform is built on. Applies to processing in Waysayer — both when a customer uses the service, and when Fastpath uses it itself.
Where the data location is stated as service-dependent, the specific use and configuration of the provider determines which geographical controls apply. For global DNS and edge services we therefore do not state EU storage without specific configuration or agreement.
| Provider | Service | Data location | Transfer basis |
|---|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | Cloud infrastructure for Waysayer. Primary data storage and regional services use AWS regions within the EU. Certain global services, including CloudFront, AWS WAF protection associated with CloudFront, and Route 53, are delivered through a global network and may process limited technical request and security data. | Service-dependent | EU standard contractual clauses where required |
| Cloudflare, Inc. | DNS, security and file/object storage for Waysayer. File storage is located in the EU. DNS and edge services are delivered through a global network. | Service-dependent | EU standard contractual clauses / EU–US Data Privacy Framework (global network) |
| Microsoft (Microsoft Ireland Operations Limited) | Cloud services that form part of the delivery of Waysayer, including e-mail in support and notification flows. Fastpath uses regions within the EU unless otherwise stated in the service description. The Microsoft EU Data Boundary applies; limited processing or access outside the boundary may occur under the provider’s terms. | EU | EU standard contractual clauses / EU–US Data Privacy Framework |
| Anthropic (Anthropic Ireland, Limited) | Internal AI tools used in Fastpath’s development, security and operations work. See the note on AI tools below the table. | USA | EU standard contractual clauses |
| OpenAI (OpenAI Ireland Limited) | Internal AI tools used in Fastpath’s development, security and operations work. See the note on AI tools below the table. | USA | EU standard contractual clauses |
AI tools listed in the table above are used by Fastpath as internal aids in development, security and operations work, including troubleshooting, maintenance and incident handling. The tools are not offered to the customer as features of Waysayer. We work to limit which personal data can reach the tools, including through classification of fields that contain personal data, limiting the logging of content, masking credentials in API logs, and working mainly with configuration, metadata and test data. The material may nevertheless contain personal data, for example from logs and event data when troubleshooting and handling security events. Such processing is covered by Fastpath's data processing agreement with the customer. Transfers outside the EEA rely on the European Commission's standard contractual clauses (SCC).
Map and location services in Waysayer are provided by Google (Google Cloud EMEA Limited). Google processes the data in these services as an independent controller under Google's terms for Google Maps Platform, and is therefore not listed as a sub-processor. Data is sent to Google only when map or location features are used.
The list shows which providers we use, not every individual service with them. If we adopt a new provider, the list is updated before it is taken into use, and customers are notified in accordance with the data processing agreement.
Websites and marketing pages
Providers used for fastpath.no and selected marketing and informational pages about Waysayer published by Fastpath. The Waysayer platform and publicly accessible pages delivered through its modules are covered by the platform list above.
| Provider | Service | Data location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Hosting and delivery of fastpath.no and selected marketing and informational pages about Waysayer published by Fastpath. This does not include the Waysayer platform itself or publicly accessible pages delivered through its modules, such as surveys, forms and booking pages. When these pages are visited, Vercel may process technical request and log data, such as IP addresses. The pages are delivered through Vercel’s global network, and processing may take place outside the EEA. | Varies | EU standard contractual clauses / EU–US Data Privacy Framework |
Support, consulting and own business
Tools for e-mail, internal collaboration, case tracking, CRM, finance and agreements. In support and consulting assignments, personal data related to the assignment may to a limited extent occur in these tools, for example in e-mail and case tracking. The providers are then sub-processors for that work under the data processing agreement.
| Provider | Service | Data location | Transfer basis |
|---|---|---|---|
| Microsoft (Microsoft Ireland Operations Limited) | Productivity tools (Microsoft 365), including e-mail, in support, consulting work and Fastpath’s own business | EU | EU standard contractual clauses / EU–US Data Privacy Framework |
| Salesforce (SFDC Ireland Limited) | CRM for Fastpath’s own customer management | EU | Binding corporate rules / EU standard contractual clauses / EU–US Data Privacy Framework |
| Tripletex AS | Accounting system | EU | Not applicable (EEA) |
| Slack Technologies Limited | Internal communication | EU | Binding corporate rules / EU standard contractual clauses / EU–US Data Privacy Framework |
| Atlassian Pty Ltd | Project management and documentation | EU (Jira, Confluence); USA (Trello) | EU standard contractual clauses / EU–US Data Privacy Framework |
| Oneflow AB | Electronic signing of agreements | EU | EU standard contractual clauses for certain sub-processors |
| Backblaze, Inc. | Encrypted backup with keys controlled by Fastpath | EU | EU standard contractual clauses |