Subprocessors used by Nyttio
This page identifies external providers that may process customer data on behalf of Nyttio. The register is version-controlled in Nyttio's code and will be the source for a future PDF version.
How to read this register
Each record shows the service, why it is needed, where processing is planned and its status. “Preparing” means a solution exists in Nyttio's plan or code but must not be used for real customer data.
Current and prepared providers
| Provider and service | Purpose | Region | Data | Status |
|---|---|---|---|---|
| Microsoft Azure – Nyttio operations | Application, database, object storage, secret management and monitoring according to the selected Azure configuration. | Sweden Central as planned primary region; actual account and services must be checked before production. | Account, permission and business data needed in the enabled service. | Preparing/configuring. Contract and region checks are required before production data. |
| Microsoft Azure AI Document Intelligence | Interpret a document when the user expressly chooses the OCR function; the result is a review suggestion. | Sweden Central. Only EU Member State regions are approved for this integration. | The document chosen by the user, which may contain contact and invoice data. | Preparing. Requires the user's choice and the controls in Nyttio's OCR material. |
| Amazon Web Services (AWS) – SES, S3, SNS, SQS, Lambda and KMS | Receive email to an opaque invoice address, perform security checks, queue it and deliver approved attachments to Invoice inbox. | eu-north-1 (Stockholm) for the scoped staging solution. | Email technical data, raw email and attachments may contain supplier, contact and invoice information. | Approved for staging using synthetic test data. Not enabled for real customer data or production. |
Protections for AWS staging
- Only the European Stockholm region is used for this solution.
- Raw email and attachments are private and encrypted. Access must use least-privilege permissions.
- Keys are rotated so staging, development and future production do not share secrets or need to break existing addresses during a change.
- Before real data is used, TellMeTellus must have checked the AWS agreement and DPA, decided how long raw email and quarantine are kept, and completed the final technical review.
How changes are handled
The register is updated before a new subprocessor or material change is used. Where customers' general authorisation is used, affected customers will receive advance information and may make a substantiated objection under the data processing agreement.
TellMeTellus will review providers' published subprocessor information at least quarterly and additionally before material changes to a region, service or support arrangement.
- AWS subprocessor listAWS's current published list of its own service providers.
- AWS Data Processing AddendumAWS information on how the DPA relates to the customer's AWS agreement.