Agreements
Subprocessors
Last updated: 5 May 2026
When Digiserv delivers cloud services, IT operations, security and other services to our customers, we use a selection of subprocessors that process personal data on our behalf. This list fulfills the duty to inform in section 4.4 of our data processing agreement.
We add new subprocessors to the list at least 14 days before they are engaged. If you would like to be notified of changes, or wish to object to a specific subprocessor, contact us at databehandler@digiserv.no.
About location: The column shows where the personal data is primarily processed. “EEA” means processing within the EU/EEA. “(adequacy)” means a country covered by an adequacy decision of the European Commission. “(SCC/DPF)” means that transfers to third countries take place on the basis of standard contractual clauses or the EU–US Data Privacy Framework. The exact region is verified against each supplier's data processing agreement.
Operations, monitoring and security
| Supplier | Service | Data types | Location |
|---|---|---|---|
| NinjaOne | Managed workstations, remote management (RMM), remote support and patch management | Asset data, usernames, IP addresses, event logs | USA (SCC/DPF) |
| Sophos | Endpoint and network security | Threat data, event logs, asset metadata | United Kingdom (adequacy) |
| Webroot | Antivirus and endpoint protection | Asset data, threat detection, event logs | USA (SCC/DPF) |
| Augmentt | Security monitoring of Microsoft 365 | User data, sign-in logs, configuration | Canada (adequacy) |
| CIPP (Cyberdrain) | Administration and reporting for Microsoft 365 | User data, licenses, configuration | EEA / third country (SCC/DPF) |
Cloud services
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Microsoft | Microsoft 365 (Exchange, Teams, OneDrive, SharePoint), Azure | Email, documents, calendars, Teams messages, user data | EU (EEA) |
| Amazon Web Services (AWS) | Server and application hosting (includes self-hosted backup, network administration, etc.) | Depends on the customer's application | Sweden (EEA) |
Backup
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Dropsuite | Backup of Microsoft 365 (email, OneDrive, SharePoint) | Email, documents, attachments | EEA / third country (SCC/DPF) |
Domains and certificates
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Norid | Registry for the .no top-level domain (independent controller for the registry) | Domain registrant: name, address, email, organization number | Norway |
| CentralNic | Registrar for international domains (.com, .net, etc.) | Domain registrant: name, address, email, organization number | EEA / third country (SCC/DPF) |
| The SSL Store (DigiCert) | Issuance of TLS certificates | Administrative and technical contact person | USA (SCC/DPF) |
Network
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Ubiquiti (UniFi Cloud) | Cloud management of UniFi network equipment | Configuration, client logs, MAC addresses | USA (SCC/DPF) |
Email and training
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Letsignit | Central management of email signatures | Employee names, job titles, contact information | EEA |
| Nimblr | Phishing simulation and security awareness training | Employee names, email, training results | EEA |
Migration
| Supplier | Service | Data types | Location |
|---|---|---|---|
| AvePoint | Migration of data to/between Microsoft 365 tenants | Email, documents and user data during migration | EEA / third country (SCC/DPF) |
SMS messaging
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Smskiosken | Sending of SMS notifications and messages on behalf of the customer | Mobile number and message content | Norway |
Business systems
| Supplier | Service | Data types | Location |
|---|---|---|---|
| Mobit Norge (Multicase) | ERP and purchasing system hosted by the Mobit chain | Customer name, organization number, contact information, orders | Norway |
| Tripletex | Accounting and invoicing | Invoice data, customer name, organization number, contact information | Norway |
Transfer of personal data outside the EEA
Some subprocessors process personal data in the USA or other third countries. For such transfers, Digiserv relies on the European Commission's standard contractual clauses (SCC) or adequacy decisions (for example the EU-US Data Privacy Framework) in accordance with Chapter V of the GDPR.
Processors for our website
The list above covers the processors we use to deliver services to you as a customer. The digiserv.no website itself also uses certain processors that concern visitors to the website – including Cloudflare (spam protection), Anthropic (AI-powered domain search) and Google (analytics). These are described in our privacy policy.
Other partners
We also work with several parties that are not processors under GDPR Article 28, because they process personal data on their own legal basis or because no personal data flows between us. Domain registrars (such as Norid) also act as independent controllers for the domain register itself and WHOIS. Examples:
- DLL (De Lage Landen) – leasing company that is an independent controller for credit and customer checks in connection with hardware lease agreements.
- Let's Encrypt – issuance of public TLS certificates. No personal data is involved.
- Distributors – when hardware and licenses are purchased, the suppliers act as independent controllers for their own logistics and invoicing.
Questions or objections
Questions about the list, or objections to the use of a specific subprocessor, should be sent to databehandler@digiserv.no or by post to Digiserv AS, Gismerøyveien 89, 4515 Mandal, Norway.