Draft, as of 19 October 2026. This translation is for information only; the German version is binding. Complete and have it legally reviewed before publication.
What is a subprocessor?
When we process personal data for our customers, we are a processor. Service providers that help us with this and are given access to this data for that purpose are called subprocessors (Art. 28(2) and (4) GDPR).
Selection and contracts
Before engaging a service provider, we check whether it implements appropriate technical and organisational measures. With each of them we conclude a contract that ensures at least the level of protection of our own data processing agreement. For service providers outside the EU, we additionally safeguard the transfer, for example with the European Commission’s standard contractual clauses.
Current list
| Service provider | Purpose | Place of processing |
|---|---|---|
| Anthropic PBC, San Francisco, USA | AI answers for agents and flows (Claude language model) | USA |
| Cloudflare, Inc., San Francisco, USA | Encrypted transfer between the browser and our server (network and tunnel) | worldwide, incl. EU and USA |
| IONOS SE, Montabaur, Germany | Sending and receiving emails | Germany |
| Stripe Payments Europe, Limited, Dublin, Ireland | Processing payments and subscriptions | EU and USA |
In the Enterprise plan, the customer operates the server itself. In that case only the AI provider is involved as a subprocessor, unless the customer concludes its own contract with it.
Changes
We announce new subprocessors at least 30 days in advance. Customers may object for good cause under data protection law. If we cannot reach an agreement, the customer may terminate the affected contract.
Data processing agreement
We will send you our data processing agreement on request to [email protected].