Infrastructure we operate
The object storage, database, identity provider, and observability tooling are operated by us on the infrastructure listed above and are not separate subprocessors.
Trust
Subprocessors
These are the subprocessors engaged for personal data contained in documents. This page is the public notice of that list. We will notify you at least 30 days before adding or replacing a subprocessor.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| netcup GmbH, Germany | Hosting and infrastructure for all services, the database, and object storage | All personal data processed under the DPA, at rest | Germany | Not applicable — within the EU |
| OpenAI | Extraction of data from documents by machine learning models | Content of uploaded documents, including any personal data it contains | European Union and United States | Standard Contractual Clauses under the subprocessor's data processing addendum |
| Sendinblue SAS, trading as Brevo, France | Transactional email delivery | Email addresses and names of your users. No document content. | France | Not applicable — within the EU |
The English DPA Annex III is the binding list.
What this list does not include
Payment provider
Our payment provider is not a subprocessor under the DPA. It receives payment and billing data relating to your account, never the content of a document. That processing is described in the Privacy Policy .
The binding list is Annex III of the Data Processing Agreement . A change to that annex is a change to this page.