Sub-processors
Aprex uses the providers below to operate Hej CRM. This list describes the intended setup; actual regions, contracts and transfer mechanisms must be confirmed before launch.
Vercel
Purpose: web app hosting, server functions, content delivery and security. Intended location: EU region, with Frankfurt (fra1) for server functions where the project permits. Vercel operates a global CDN, so traffic may route through locations outside the EU. Transfers: Vercel’s data processing addendum with standard contractual clauses and/or the EU–US Data Privacy Framework where its requirements are met.
Neon
Purpose: storage and backups for CRM and account data. Intended location: AWS Europe Central 1, Frankfurt, Germany. Transfers: Neon’s data processing agreement and standard contractual clauses if data is transferred outside the EEA. The production region and backup location must be checked.
Postmark
Purpose: delivery of verification, password reset, invitation and quote emails. Disclosed location: primary operations and data centres in the United States; the provider says it has no EU servers. Transfers: Postmark’s data processing addendum with EU standard contractual clauses. Email content and recipient addresses are processed to deliver messages.
Sentry
Purpose: error and performance monitoring. Intended location: Germany (EU region). Error reports may include technical identifiers and context unless instrumentation filters them. Transfers: Sentry’s data processing addendum, standard contractual clauses and, where applicable, the EU–US DPF. The account region and data minimisation must be confirmed.
Stripe
Purpose: subscriptions, billing, payment status and the billing portal. Stripe may process payment and contact data globally, including in the United States. Aprex does not receive card numbers through Hej CRM. Transfers: Stripe’s data processing addendum and data transfers addendum, using standard contractual clauses and any applicable adequacy decision.
OpenAI
Purpose: processing content a user sends to selected AI features, such as meeting notes. Assumed setup: an API project with EU data residency, the EU endpoint and approved Zero Data Retention/Modified Retention, so customer content is not stored at rest by OpenAI. This requires eligibility, enabled controls and a model that supports the region. System data may not be covered by EU residency or zero retention. Transfers: OpenAI’s data processing addendum, standard contractual clauses or an adequacy decision where applicable.