Security & sovereignty

Subprocessors by purpose and processing region.

Not every provider receives the same data. This overview groups providers by function and shows their documented processing region.

Read the register together with the actual data path.

The register names external service providers that may support platform operations, model processing or supplementary functions. For each entry, it shows the purpose and documented processing region. This makes the provider’s general role transparent.

Whether a provider actually processes data for a specific use case depends on the enabled functions and approved model path. The register is therefore the complete provider overview, but it does not imply that every provider participates in every processing activity.

Current register

Subprocessors by purpose and region

The entries come from the centrally maintained register. Providers, purposes and regions are therefore not kept as separate marketing copy on this page.

Hetzner
Core infrastructureHetzner

Hosting of the entire platform – chats, accounts, data vault and documents run on dedicated infrastructure in Germany (ISO 27001, BSI C5).

Germany (Nuremberg, Falkenstein)

Platform & Hosting

  • Ubicloud
    Ubicloud

    Managed databases & open-source model inference – operated inside the Hetzner data centres.

    EU – Hetzner data centres (Germany)
  • bunny.net
    bunny.net

    DDoS protection, web application firewall and image CDN.

    EU – Slovenia
  • Scaleway
    Scaleway

    Backup infrastructure (European provider, Iliad group).

    EU – France

AI services

  • Azure OpenAI
    Azure OpenAI

    LLM inference (GPT models) & image generation in EU data centres.

    EU (Sweden, France)
  • OpenAI (EU)
    OpenAI (EU)

    LLM inference (GPT models) with EU data residency (eu.api.openai.com).

    EU – data residency
  • Google Cloud
    Google Cloud

    Vertex AI / Gemini and Claude inference.

    EU – Frankfurt (europe-west3)
  • Mistral AI
    Mistral AI

    LLM inference (Mistral models) & OCR.

    EU (France / Sweden)
  • DeepL
    DeepL

    Machine translation & writing assistance.

    Germany (AWS Frankfurt)
  • Gladia
    Gladia

    Speech-to-text (meeting & audio transcription).

    EU – France
  • Nebius
    Nebius

    Open-source model inference & embeddings.

    EU – Finland
  • Verda
    Verda

    Custom AI model hosting (data centres in Finland, 100% renewable energy).

    EU – Finland
  • TensorX
    TensorX

    Open-source model inference (EU-sovereign inference).

    EU – Ireland
  • AWS
    AWS

    AI model hosting (AWS Bedrock).

    EU – Frankfurt

Web search

  • Linkup
    Linkup

    AI web search for agents.

    EU – Azure (France)

In the platform

What can be controlled and reviewed in practice.

Function

The grouping shows whether a service supports platform operations, model processing or a supplementary function.

Region

The stated region describes the documented processing framework of the service. It does not replace reviewing the actual data path.

Contractual framework

Subprocessors are used within the intended data-protection and contractual framework and maintained in the central register.

Important context

The list shows potential participants. The services that actually process data for a specific use case depend on the functions and model paths used.

More security topics

Data paths & modelsView topicAccess & operationsView topicSovereigntyView topicEvidenceView topic

Ask our security team

For questionnaires, technical reviews or a specific use case, our team provides the appropriate level of detail.

Contact the security team