Sub-processors

1. Hosting and infrastructure

• Hetzner Online GmbH — application servers and database hosting, Germany/Finland (EU).
• Amazon Web Services, Inc. (CloudFront) — content delivery network serving the landing-page background video; loading the page exposes the visitor's IP address and browser user-agent to AWS (US). Needs legal reviewconfirm AWS DPA and EU–US Data Privacy Framework coverage, and decide whether the video should be self-hosted in the EU or loaded only after consent
• Functional Software, Inc. (Sentry) — error monitoring for the API, engaged only when the operator configures SENTRY_DSN; events are stripped of request bodies, cookies and personal identifiers before leaving the process, and the organisation must use EU data residency (de.sentry.io).
• Needs legal reviewany additional infrastructure providers, e.g. object storage, with location

2. Transactional email

• Needs legal reviewemail delivery provider, location and transfer mechanism

3. AI model providers

Model endpoints are configured by the platform administrator and prefer EU regions. Only pseudonymized content reaches a model provider.

• Needs legal reviewlist the active model providers, their regions and the transfer mechanism for any non-EU provider

4. Messaging platforms

• Meta Platforms Ireland Ltd — WhatsApp Business Cloud API (when a WhatsApp number is connected by the customer).
• Telegram FZ-LLC — Telegram Bot API (when a Telegram bot is connected by the customer).

5. Changes to this list

Workspace owners are notified at least 14 days before a new sub-processor starts processing personal data and may object as described in the Data processing agreement.