Schedule 2 to Data Processing Agreement

List of Sub-Processors

This list is Schedule 2 to the True Aim AG Data Processing Agreement. As updated under the DPA, it is the operative list for the purposes of the DPA.

Microsoft Ireland Operations Ltd

Entity: Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Service: Cloud infrastructure and hosting (Microsoft Azure), deployed in the Company’s Azure tenant. This covers compute, database, storage, AI model inference, document processing, key management, monitoring and networking.
Personal Data Affected: All categories of Personal Data listed in clause 4: identification data, policy and claim references, claim-related data (including Sensitive Personal Data where the claim requires it) and financial data. Also platform telemetry (request metadata) and authorised-user account data.
Location: All data at rest is stored in Switzerland North (Zurich), and document processing runs there too. AI model inference runs inside the Microsoft EU Data Boundary (the EU and EFTA states, including Switzerland) and stores no data outside Switzerland North.

Entity: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Service: Business email, document storage and calendar (Google Workspace), used for client communications and operational coordination. For clients who submit claims by email, it also receives claim correspondence and attachments in a dedicated mailbox, and the Platform collects them from there automatically.
Personal Data Affected: Identification data. Claim-related Personal Data, including identity documents and other attachments, in claim correspondence that clients send by email. Any claim-related Personal Data that clients or Data Subjects include in other correspondence or shared documents.
Location: European Union (Google Workspace data region set to Europe). Governed by the Google Cloud / Workspace Data Processing Addendum and the EU Standard Contractual Clauses.

Entity: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States
Service: Error and performance monitoring for the Platform.
Personal Data Affected: Authorised-user account data (user identifier, email address) and request metadata that appear in application error reports. Claim-related Personal Data can reach an error report despite filtering.
Location: European Union (Sentry data region in Germany). Transfers to the United States rely on the EU-U.S. Data Privacy Framework and its Swiss extension, backed by the Standard Contractual Clauses with the Swiss FADP amendments.

Entity: Slack Technologies Limited, 4th Floor, One Park Place, Hatch Street Upper, Dublin 2, D02 W085, Ireland
Service: Internal team communication, used by Company staff to coordinate operations and troubleshoot. Claim-related Personal Data may be referenced there.
Personal Data Affected: Identification data, and any claim-related Personal Data that staff reference in messages, threads or shared files.
Location: European Union (Slack EU data residency for messages and shared files at rest). Governed by the Slack Customer Terms of Service Data Processing Addendum.

Version	Effective Date	Summary of Changes
1.1	2026-09-24	Added Sentry. Widened the Google Workspace entry to cover claims submitted by email. Clarified where Microsoft Azure runs AI inference.
1.0	2026-08-17	First published as Schedule 2 to the Data Processing Agreement dated 2026-08-16.

Questions about this list? Contact info@trueaim.ai.

True Aim AG · Metallstrasse 9, 6300 Zug, Switzerland · CHE-325.128.066