Sub-processors
This English version is provided for convenience. The Dutch version is the binding one.
This page holds the current overview of every third party Trainiq uses to deliver the Service. The list is an integral part of our data processing agreement (see article 23 of the terms and conditions).
Criticality levels
We rate sub-processors by how critical they are to the platform:
- K Critical: an outage blocks the core service immediately (hosting, database)
- H High: an outage blocks an important flow within 24 hours (payments, e-mail)
- M Medium: an outage limits the customer experience without stopping the core service
- L Low: an outage is a nuisance but can be worked around
Trainiq's sub-processors
Parties with which Trainiq itself has a direct contractual relationship and that may touch data of all customers.
| Sub-processor | Service | Location | Crit. | Certifications | Data categories |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Hosting / VPS infrastructure | Germany (EU) | K | ISO 27001, ISO 9001, SOC 1/2 Type II | All customer data (databases, logs, sessions) |
| Brevo (Sendinblue SA) | Transactional e-mail (confirmations, certificates, reminders) | France (EU) | H | ISO 27001, ISO 27017, ISO 27018, GDPR | Name, e-mail address, e-mail content |
| Mistral AI (Mistral AI SAS) | Language model behind the AI assistant Quinn | France (EU) | M | GDPR, data processing agreement | Usage questions and planning instructions, no data of participants or contact persons (blocked by a PII detector before sending) |
| TransIP B.V. | Domain registration + DNS | Netherlands (EU) | M | ISO 27001 | DNS records (public metadata, no customer PII) |
Point of attention: Mistral AI for the assistant
Quinn, the assistant in the training provider portal, uses a language model from Mistral AI. The following safeguards apply:
- Processing only through Mistral's European endpoint: no transfer to the United States
- A local PII detector blocks e-mail addresses, citizen service numbers, IBANs, phone numbers and names of contact persons before sending; if a question contains one, the question is refused
- Names of participants and instructors are replaced by an internal reference before sending and put back afterwards, so a planner can simply say "move Jan Bakker" while the provider sees the reference and never the name
- The option to use input and output for model training is switched off
- Mistral keeps input and output for 30 days to detect abuse and deletes them afterwards
- Refused questions are logged for audit purposes, without storing the detected term itself
Sub-processors you activate yourself
Through Trainiq Connect you choose which accounting software and which payment provider to connect. The connection itself runs per training provider on our own Hetzner servers (see the first table) and is therefore not a separate sub-processor. Below are the providers training providers use most often; if you use a different package the same applies: you hold the contract, Trainiq only passes data through. You activate the connection on your settings page (/admin/integraties). Trainiq is purely a conduit for data; you maintain the direct contractual relationship and are responsible for your own data processing agreement with these parties.
| Sub-processor | Service | Location | Who holds the contract? | Certifications |
|---|---|---|---|---|
| Mollie B.V. | Online payments (cards, bank transfers, local methods) | Netherlands (EU) | Customer | PCI DSS Level 1, ISO 27001, SOC 2 |
| Stripe Payments Europe Ltd. | Online payments (alternative) | Ireland (EU) | Customer | PCI DSS Level 1, SOC 2 Type II |
| Buckaroo B.V. | Online payments (alternative) | Netherlands (EU) | Customer | PCI DSS Level 1, licensed by the Dutch central bank (DNB) |
| Informer Online B.V. | Accounting / invoicing | Netherlands (EU) | Customer | ISO 27001 |
| Moneybird B.V. | Accounting / invoicing (alternative) | Netherlands (EU) | Customer | ISO 27001 |
| Exact Online (Exact Group B.V.) | Accounting / invoicing (alternative) | Netherlands (EU) | Customer | ISO 27001, ISAE 3402 Type II |
Changes and right to object
Before we put a new sub-processor live or replace an existing one, we announce it at least 30 days in advance on this page and by e-mail to our customers. The announcement names the party, the service, the location, the certifications and which data is exchanged.
Do you have a reasoned objection to a new sub-processor? Send it by e-mail to info@trainiq.nl. We will then discuss a suitable solution with you: an alternative sub-processor, a customer-specific configuration or, as a last resort, termination of the Agreement without further obligation (see article 23 of the terms and conditions).
What do we review every year?
Once a year (or after significant changes) we reassess every sub-processor on:
- Certification status: have certifications been kept, lapsed or newly obtained?
- Breach history: were any incidents reported in the past 12 months?
- Location and jurisdiction: is processing still within the EU? Any changes in ownership?
- Service level: SLA achieved, price changes, support channels
- Validity of the DPA: is a valid data processing agreement still in force?
Questions?
Questions about our chain of sub-processors? E-mail info@trainiq.nl or call +31 85 071 1114.