Version for the beta and pilots. Version undergoing final validation. The final version may contain minor adjustments.
Subprocessors
Last updated 10 October 2026
These are the providers that may receive personal data processed by Homono: what they receive, where they process it and under which safeguard.
Some are used for every workspace; others only if the workspace uses the corresponding service. Providers acting as « independent controllers » process the data under their own responsibility, according to their own terms.
| Provider | Purpose | Country of processing | Transfer safeguard |
|---|---|---|---|
| AnthropicAnthropic (entité contractante à confirmer)Homono subprocessorAlwaysTo be confirmed · 9 October 2026 | Conversational assistants (tenants and managers), letter drafting, lease preparation, online help, document reading (including identity documents, bank documents, insurance contracts and invoices), meter readings and qualification of maintenance requests.Data: Questions asked and the context needed to answer them (lease, payments, maintenance), documents and photos submitted for reading. | United States and other countries outside the European Economic Area. | European Commission standard contractual clauses. API data deleted within 30 days and, by default, not used for training. |
| Cloudflare R2Cloudflare, Inc.Homono subprocessorAlwaysTo be confirmed · 9 October 2026 | Storage of documents, photos and backups.Data: Documents and photos uploaded to or generated in the application; database backups. | Storage placed in Western Europe; Cloudflare is a US company. | EU–US Data Privacy Framework (certification stated by Cloudflare), standard contractual clauses otherwise. |
| RailwayRailway CorporationHomono subprocessorAlwaysTo be confirmed · 9 October 2026 | Hosting of the application and the database.Data: All application data. | Servers and database in the Netherlands; Railway states that its primary processing operations take place in the United States. | EU–US Data Privacy Framework (certification stated by Railway), standard contractual clauses otherwise. |
| ResendResend, Inc.Homono subprocessorAlwaysTo be confirmed · 9 October 2026 | Sending e-mails, by default for all workspaces — except a workspace that has configured its own e-mail server or Google mailbox.Data: E-mail address, name, message content. | United States. | EU–US Data Privacy Framework (certification stated by Resend) and standard contractual clauses. |
| Bancontact PayconiqBancontact Payconiq Company NVIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Mobile payment link on documents.Data: Payment amount and reference; payer data processed by Bancontact Payconiq. | Belgium. | No announced transfer outside the Union. |
| CM.comCM.com Netherlands B.V.Homono subprocessorDepending on configurationVerified on 9 October 2026 | Sending text messages.Data: Phone number, message content. | European Union (Netherlands). | No transfer outside the Union for the service used. |
| Gmail (Google Workspace)Google Cloud EMEA LimitedHomono subprocessorDepending on configurationVerified on 9 October 2026 | Sending e-mails from a Google Workspace mailbox.Data: E-mail address, name, message content. | Countries where Google has facilities, including the United States. | EU–US Data Privacy Framework and standard contractual clauses (Cloud Data Processing Addendum). |
| Google Maps PlatformGoogle Cloud EMEA LimitedIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Validation of entered addresses.Data: Postal address entered. | Countries where Google has facilities, including the United States. | EU–US Data Privacy Framework or standard contractual clauses (Google controller-to-controller terms). |
| itsmeBelgian Mobile ID NVIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Electronic signature of the lease.Data: Signer identity data, passed on by itsme with the signer's consent. | European Union. | No announced transfer outside the Union. |
| mybanx.iomybanxIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Reading bank accounts to reconcile rent payments.Data: Bank transactions of linked accounts. | European Union (mainly France). | Standard contractual clauses for any transfer outside the Union. |
| PontoIsabel NVIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Reading bank accounts to reconcile rent payments (account information service).Data: Bank transactions of linked accounts: amounts, dates, references, counterparties. | Belgium. | Payment institution licensed by the National Bank of Belgium. |
| Serveur e-mail (SMTP)Fournisseur désigné lors de la configurationHomono subprocessorDepending on configurationTo be confirmed · 9 October 2026 | Sending e-mails through an SMTP server.Data: E-mail address, name, message content. | Depends on the designated provider. | Depends on the designated provider; named here once in use. |
| Services de notification des navigateursService choisi par le navigateur de l'appareil (Apple, Google, Mozilla, Microsoft)Technical intermediaryDepending on configurationTo be confirmed · 9 October 2026 | Routing notifications to the device.Data: Encrypted message, unreadable by the service; subscription address, time and size of the sending. | Depends on the browser's service; likely the United States. | Content end-to-end encrypted: the service cannot access it. |
| WeroEuropean Payments InitiativeIndependent controllerDepending on configurationTo be confirmed · 9 October 2026 | Mobile payment link (not yet in service).Data: None until the service opens. | European Union. | To be specified when the service opens. |
| WhatsApp (Meta)WhatsApp Ireland LimitedHomono subprocessorDepending on configurationVerified on 9 October 2026 | Notifications and document delivery to tenants who opted in.Data: Phone number, name, message content. | Meta data centres, including the United States. | EU–US Data Privacy Framework and standard contractual clauses (WhatsApp Business transfer addendum). |
- AnthropicAnthropic (entité contractante à confirmer) · Homono subprocessorAlways
- Purpose
- Conversational assistants (tenants and managers), letter drafting, lease preparation, online help, document reading (including identity documents, bank documents, insurance contracts and invoices), meter readings and qualification of maintenance requests.
- Data
- Questions asked and the context needed to answer them (lease, payments, maintenance), documents and photos submitted for reading.
- Country of processing
- United States and other countries outside the European Economic Area.
- Transfer safeguard
- European Commission standard contractual clauses. API data deleted within 30 days and, by default, not used for training.
- Cloudflare R2Cloudflare, Inc. · Homono subprocessorAlways
- Purpose
- Storage of documents, photos and backups.
- Data
- Documents and photos uploaded to or generated in the application; database backups.
- Country of processing
- Storage placed in Western Europe; Cloudflare is a US company.
- Transfer safeguard
- EU–US Data Privacy Framework (certification stated by Cloudflare), standard contractual clauses otherwise.
- RailwayRailway Corporation · Homono subprocessorAlways
- Purpose
- Hosting of the application and the database.
- Data
- All application data.
- Country of processing
- Servers and database in the Netherlands; Railway states that its primary processing operations take place in the United States.
- Transfer safeguard
- EU–US Data Privacy Framework (certification stated by Railway), standard contractual clauses otherwise.
- ResendResend, Inc. · Homono subprocessorAlways
- Purpose
- Sending e-mails, by default for all workspaces — except a workspace that has configured its own e-mail server or Google mailbox.
- Data
- E-mail address, name, message content.
- Country of processing
- United States.
- Transfer safeguard
- EU–US Data Privacy Framework (certification stated by Resend) and standard contractual clauses.
- Bancontact PayconiqBancontact Payconiq Company NV · Independent controllerDepending on configuration
- Purpose
- Mobile payment link on documents.
- Data
- Payment amount and reference; payer data processed by Bancontact Payconiq.
- Country of processing
- Belgium.
- Transfer safeguard
- No announced transfer outside the Union.
- CM.comCM.com Netherlands B.V. · Homono subprocessorDepending on configuration
- Purpose
- Sending text messages.
- Data
- Phone number, message content.
- Country of processing
- European Union (Netherlands).
- Transfer safeguard
- No transfer outside the Union for the service used.
- Gmail (Google Workspace)Google Cloud EMEA Limited · Homono subprocessorDepending on configuration
- Purpose
- Sending e-mails from a Google Workspace mailbox.
- Data
- E-mail address, name, message content.
- Country of processing
- Countries where Google has facilities, including the United States.
- Transfer safeguard
- EU–US Data Privacy Framework and standard contractual clauses (Cloud Data Processing Addendum).
- Google Maps PlatformGoogle Cloud EMEA Limited · Independent controllerDepending on configuration
- Purpose
- Validation of entered addresses.
- Data
- Postal address entered.
- Country of processing
- Countries where Google has facilities, including the United States.
- Transfer safeguard
- EU–US Data Privacy Framework or standard contractual clauses (Google controller-to-controller terms).
- itsmeBelgian Mobile ID NV · Independent controllerDepending on configuration
- Purpose
- Electronic signature of the lease.
- Data
- Signer identity data, passed on by itsme with the signer's consent.
- Country of processing
- European Union.
- Transfer safeguard
- No announced transfer outside the Union.
- mybanx.iomybanx · Independent controllerDepending on configuration
- Purpose
- Reading bank accounts to reconcile rent payments.
- Data
- Bank transactions of linked accounts.
- Country of processing
- European Union (mainly France).
- Transfer safeguard
- Standard contractual clauses for any transfer outside the Union.
- PontoIsabel NV · Independent controllerDepending on configuration
- Purpose
- Reading bank accounts to reconcile rent payments (account information service).
- Data
- Bank transactions of linked accounts: amounts, dates, references, counterparties.
- Country of processing
- Belgium.
- Transfer safeguard
- Payment institution licensed by the National Bank of Belgium.
- Serveur e-mail (SMTP)Fournisseur désigné lors de la configuration · Homono subprocessorDepending on configuration
- Purpose
- Sending e-mails through an SMTP server.
- Data
- E-mail address, name, message content.
- Country of processing
- Depends on the designated provider.
- Transfer safeguard
- Depends on the designated provider; named here once in use.
- Services de notification des navigateursService choisi par le navigateur de l'appareil (Apple, Google, Mozilla, Microsoft) · Technical intermediaryDepending on configuration
- Purpose
- Routing notifications to the device.
- Data
- Encrypted message, unreadable by the service; subscription address, time and size of the sending.
- Country of processing
- Depends on the browser's service; likely the United States.
- Transfer safeguard
- Content end-to-end encrypted: the service cannot access it.
- WeroEuropean Payments Initiative · Independent controllerDepending on configuration
- Purpose
- Mobile payment link (not yet in service).
- Data
- None until the service opens.
- Country of processing
- European Union.
- Transfer safeguard
- To be specified when the service opens.
- WhatsApp (Meta)WhatsApp Ireland Limited · Homono subprocessorDepending on configuration
- Purpose
- Notifications and document delivery to tenants who opted in.
- Data
- Phone number, name, message content.
- Country of processing
- Meta data centres, including the United States.
- Transfer safeguard
- EU–US Data Privacy Framework and standard contractual clauses (WhatsApp Business transfer addendum).
Client managers are notified by e-mail before any subprocessor is added or replaced.
Change history
- 10 October 2026 — Resend is now marked “Always”: it sends the e-mails of any workspace that has not configured its own sending service.
- 9 October 2026 — First publication of the named list.