Sub-processor	Purpose	Data	Location	Transfer mechanism
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of the Platform	Customer Data	Germany	–
Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland	Storage and delivery of uploaded files and assets; inference for models of Anthropic, Google and Mistral AI (Vertex AI)	Customer Data	EU for configured storage and inference; further processing outside the EU possible	Google CDPA, Appendix 3: EU-U.S. Data Privacy Framework for covered U.S. transfers; EU Standard Contractual Clauses where applicable. Transfer solution.
Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland	Inference for models of OpenAI (Azure AI Foundry, EU Data Zone); storage of disaster-recovery backups	Customer Data	EU Data Zone inference; backup storage in Germany; further processing outside the EU possible	Microsoft DPA: EU Standard Contractual Clauses and additional safeguards (Appendix C); Microsoft also participates in the EU-U.S. Data Privacy Framework.
Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France	Inference for models of DeepSeek, Alibaba Cloud (Qwen) and Z.ai (GLM)	Customer Data	EU	Scaleway runs the models; model publishers do not receive Customer Data. Transfers outside the EU are subject to the Scaleway DPA, including prior information and applicable EU Standard Contractual Clauses.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA	Content delivery and protection against malicious traffic	Network and traffic data, Customer Data in transit	Global network	Cloudflare DPA, section 6: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Raintank Inc., d/b/a Grafana Labs, 165 Broadway, 23rd Floor, New York, NY 10006, USA	Logging, metrics and tracing	Logs and technical metadata, which may contain Customer Data	Germany; access and further processing outside Germany, including in the USA, possible	EU Standard Contractual Clauses under Grafana DPA, Schedule 2.
Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA	Error monitoring, diagnostics and in-app feedback	Error and diagnostic data, user identifiers and submitted feedback, which may include Customer Data, screenshots and attachments	Germany (regional telemetry storage); further processing in the USA possible	Sentry DPA, Schedule 3: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Twilio Ireland Limited (SendGrid), 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland	Sending emails	Email addresses and email content	USA	Twilio DPA, Schedule 3: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland (PDF Embed API)	In-browser document viewer	Technical request data and anonymous usage data	PDF rendering in the User's browser; further processing by Adobe outside the EU possible	Adobe describes Standard Contractual Clauses between its relevant group companies and applicable adequacy decisions.
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Office Online viewer)	In-browser document viewer	Document URL, file name and document content	Worldwide, including the USA	Microsoft describes EU Standard Contractual Clauses and participation in the EU-U.S. Data Privacy Framework for covered transfers in its Privacy Statement.