UPDATED 16 OCTOBER 2026
File malware scanning
The SOP Hub uses attachmentAV, operated by widdix GmbH, to check new uploaded files for malware before storing them. The service was introduced before external customer onboarding and is included in the subprocessor schedule provided at registration.
What is processed
File contents are transmitted over HTTPS to attachmentAV’s EU synchronous API. This covers new uploads to Business Hub, task evidence and team-chat attachments that use our upload validation service. Existing stored files are not scanned retrospectively by this change. Files detected as infected, or whose safety cannot be confirmed by the scanner, are rejected. If scanning is unavailable, the upload is not stored and can be retried later. A scan reduces risk but cannot guarantee that a file is safe.
Provider and processing details
widdix GmbH, Blumenstr. 17/1, 73669 Lichtenwald, Germany, operates attachmentAV. Its infrastructure subprocessor is Amazon Web Services EMEA SARL, Luxembourg. The provider states that EU endpoint files are processed in Europe on encrypted temporary storage and deleted immediately after scanning. It states that synchronous scan-result metadata is not stored. This does not mean that all service or security logs are absent.
The Sophos engine scans the files. The provider says file hashes, rather than file contents, may be checked remotely using Sophos SXL. The destinations, accompanying technical information and applicable safeguards for those checks remain under review. We do not represent all scanning-related information as staying exclusively in the EU.
New customers and future changes
New customers receive the current Customer DPA and subprocessor schedule when registering. Providers disclosed and authorised at the start of that customer’s agreement are part of the initial service; there is no separate waiting period for that initial list. For subsequent additions or replacements, our DPA continues to provide at least 30 days’ advance notice and a 14-day period to raise a reasonable data-protection objection. Existing notice rights are not waived by general acceptance of an update.
Please contact hello@thesophub.com with questions or an objection, identifying your business workspace.
Related documents
Customer DPA and subprocessor schedule · Privacy notice · attachmentAV security information