Twynity Subprocessor List
The third parties that process personal data on behalf of 4th-IR Group AG — April 2026
Purpose of this list. This list sets out the subprocessors that 4th-IR Group AG uses to deliver the Twynity platform. A subprocessor is a third party that processes personal data on our behalf, under a written data processing agreement. We publish this list so you know who handles your data and where. We update it before adding any new subprocessor that will process personal data, giving at least 30 days' notice, during which you can object by closing your account or, for Twyn Subjects, by withdrawing biometric consent.
1. How we choose subprocessors
Every subprocessor on this list has been assessed against our security and data-protection requirements, including:
- recognised independent security certification (typically SOC 2 Type II and/or ISO/IEC 27001);
- a signed data processing agreement on terms at least equivalent to our own obligations;
- appropriate cross-border transfer mechanisms (EU / Swiss / UK Standard Contractual Clauses and, where applicable, the Data Privacy Frameworks);
- a contractual prohibition on using your data to train general-purpose AI models;
- audit rights and documented incident-response obligations.
2. Current subprocessors
The table below lists our subprocessors grouped by the service they provide. Region indicates where processing takes place. Where a subprocessor operates in multiple regions, we configure it so that your data is processed within the region you are subscribed to, to the extent supported by the subprocessor.
2.1 Cloud infrastructure
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
Amazon Web Services EMEA SARL | Hosting of platform, application compute, storage and networking. | Switzerland, EEA, US | SCCs; EU–US DPF; Swiss–US DPF |
Microsoft Azure (Microsoft Ireland Operations Ltd.) | Alternative hosting of compute, storage and AI services where configured. | Switzerland, EEA, US | SCCs; EU–US DPF; Swiss–US DPF |
2.2 Generative voice and video models
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
Tavus Inc. | Generation and rendering of Twyn voice and video. | US | SCCs; EU–US DPF; Swiss–US DPF |
[ElevenLabs or alternative — to be confirmed] | Voice synthesis and cloning capability within the platform. | US / EEA | SCCs; DPF where certified |
2.3 Identity verification
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
[Onfido / Veriff / alternative — to be confirmed] | Liveness detection, face-match and (for enterprise) document-based identity checks during Twyn enrolment. | EEA, UK | SCCs; UK IDTA where relevant |
2.4 Authentication and access
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
[Auth0 (Okta, Inc.) / alternative — to be confirmed] | User authentication, single sign-on and session management. | EEA, US | SCCs; EU–US DPF; Swiss–US DPF |
2.5 Payment processing
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
Stripe Payments Europe Ltd. | Processing payment for paid subscriptions. No biometric data is shared. | EEA, US | SCCs; EU–US DPF; Swiss–US DPF |
2.6 Operational tooling
Subprocessor | Purpose | Region of processing | Transfer mechanism |
|---|---|---|---|
[Customer-support platform — e.g. Zendesk / Intercom] | Handling support tickets and user communications. | EEA, US | SCCs; DPF where certified |
[Email delivery — e.g. Postmark / SendGrid] | Sending transactional and (where you consent) marketing emails. | EEA, US | SCCs; DPF where certified |
[Product analytics — e.g. first-party + Google Analytics] | Aggregate usage analytics where you have consented. | EEA, US | SCCs; EU–US DPF |
Placeholders. Items marked with square brackets will be confirmed before public launch. We commit to not processing your data through any subprocessor until the entry on this list is finalised and the associated data processing agreement is signed.
3. How we manage changes
Before adding a new subprocessor that will process personal data, we update this list and notify users at least 30 days in advance — by email to account holders, in-product, and by publication of the updated list. During that notice period you may object by:
- account holders — closing your account;
- Twyn Subjects — withdrawing biometric consent, which will cause your Twyn and biometric data to be deleted on the timelines in the Biometric Data Notice;
- enterprise customers — exercising the objection and termination rights in the applicable Data Processing Agreement.
We will not start processing through the new subprocessor until the 30-day notice period has expired.
4. Intra-group entities
Where 4th-IR Group AG shares personal data with its affiliated entities (for example, its delivery centre in Ghana) for operational support purposes, those entities act as subprocessors under an intra-group data processing agreement and are subject to the same obligations as the third-party subprocessors listed above. They appear on our internal subprocessor register and, where they process personal data of EEA or Swiss users, on this public list.
5. Questions
For any question about our subprocessors, or to request a copy of the relevant data processing agreement or transfer mechanism, contact info@4th-IR.com.
Document control. Twynity Subprocessor List. Version 1.0 — April 2026. Issued by 4th-IR Group AG, Alpenstrasse 16, 6300 Zug, Switzerland. Maintained as a living document; material changes notified at least 30 days in advance.
Related documents: Twynity Privacy Policy; Twynity Biometric Data Notice; Twynity Security Overview; Twynity Data Protection Impact Assessment; Twynity Platform Terms of Use.