Agreements
Sub-processors
Lists the sub-processors ENA Innovation uses to provide the EnaTTO service and the providers used for the website.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This page lists the sub-processors that ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") uses for personal data it processes on behalf of its customers (organizations using EnaTTO; each a "Customer") when providing the EnaTTO service. A sub-processor is a third-party service provider that processes data, which ENA Innovation processes as data processor, on ENA Innovation's behalf and on its instructions.
Each Customer uses its own Customer Environment running at organizationcode.enatto.com: a separate server with its own application stack, file storage, database and database user. The providers below are used to operate these environments.
1. Sub-processors
| Sub-processor | Service | Data categories | Location |
|---|---|---|---|
| Huawei Cloud | Hosting of Customer Environments (virtual servers, managed PostgreSQL database, storage and backups) and of ENA Cloud services | All data in the Customer Environment: directory of people, invention disclosures and IP records, projects, committees, industry, startup, training and commercialization records, documents, public form submissions, users, audit records, backups | Region set in the agreement with the Customer |
| Cloudflare | DNS, TLS and network protection (proxy) in front of Customer Environments | All traffic between users and the Customer Environment, including IP addresses and request content | Global network (headquartered in the USA) |
| Logto | Authentication and invitations for users | User's name, email address, roles, session information | Logto Cloud; locations as stated in the provider's data processing terms |
| ENA Cloud (operated by ENA Innovation) | Organization discovery, notification gateway (email delivery), AI gateway and benchmarking service | Organization code; recipient email address and message content; AI request content (not stored); aggregate yearly indicators | On Huawei Cloud |
| Resend (through ENA Cloud) | Email delivery | Recipient email address and message content | USA (sending from the EU region, Ireland) |
| Sentry (only if enabled) | Error monitoring | Error records; configured not to send personal data | Sentry cloud service (sentry.io); locations as stated in the provider's data processing terms |
| Google (Gemini, through ENA Cloud; only if the Customer switches on AI assistance) | Optional AI suggestions, matching assistance and report drafts; off by default | Only selected fields of public and internal records (for example a public technology summary, an expertise summary, the title and description of an industry demand) and aggregate indicators; never confidential or strictly confidential records, company contact details or internal notes | Google infrastructure (headquartered in the USA); locations as stated in the provider's data processing terms |
Notes:
- ENA Cloud is a service operated by ENA Innovation itself; it is not a third party. It is shown in the list for transparency. The AI gateway does not store the content of requests; it records only metadata such as size, duration and status.
- Confidential and strictly confidential records are never sent to external services. The EnaTTO server refuses AI requests for such records.
- Benchmarking is optional. Only aggregate yearly indicators (rates, durations, scores and counts per 100 staff) are sent, and only if the Customer opts in; no records, names, codes or amounts. ENA Innovation operates the benchmarking service itself.
- External data sources are not sub-processors. When a user starts a look-up, EnaTTO queries ORCID, OpenAlex or Crossref with an ORCID iD or DOI, or the European Patent Office's Open Patent Services with a publication number and the Customer's own credentials. No names, emails, notes or unpublished data are sent.
- Single sign-on: if the Customer connects its own identity provider (for example Microsoft Entra ID, Google Workspace or Okta), that provider works for the Customer and is not an ENA Innovation sub-processor.
2. Providers used for the website
ENA Innovation is the data controller for the www.enatto.com website. The providers used for it do not process data in Customer Environments:
| Provider | Service | Location |
|---|---|---|
| Vercel | Website hosting; cookieless, aggregate visit and performance statistics | USA |
| Resend (through ENA Cloud) | Forwarding contact and demo form content to our team by email | USA (sending from the EU region, Ireland) |
3. International transfers
Transfers to sub-processors located abroad are made under Article 9 of Turkish Law No. 6698 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on appropriate safeguards such as standard contracts. The safeguards used for Customers subject to the GDPR, the UK GDPR or the Swiss FADP are described in Section 17 of the Data Processing Agreement. See the Privacy Policy for details.
4. Changes
This list may change. Before adding a new sub-processor or replacing an existing one, ENA Innovation updates this page and notifies Customers within the period and in the manner set out in the Data Processing Agreement. Customers may object on reasonable grounds within the period provided in that agreement.
Questions: support@enainnovation.com