Last updated: 2026-04-19. Published under Art. 28.2 GDPR.
Eleion Scanner discloses the minimum necessary Personal Data to the sub-processors below. Any change is notified 30 days in advance. Customers with active paid subscriptions receive change notifications by email.
Technical and organizational measures at least equivalent to ours;
EU presence or Standard Contractual Clauses with documented Transfer Impact Assessment;
Data breach notification within 24 hours to Eleion as Controller-side intermediary.
Transfers outside the EEA
Where a sub-processor's infrastructure may transit or store Personal Data outside the EEA, we rely on Standard Contractual Clauses (Decision 2021/914) combined with supplementary measures:
Encryption at rest with keys managed in the EEA;
Encryption in transit (TLS 1.2+);
Minimization of Personal Data in logs and diagnostics;
Transfer Impact Assessment documented and shared under NDA on enterprise request.
Historical changes
2026-04-19 — initial sub-processor list published with Eleion Scanner v6.7.2 launch.