Trust centre
Sub-processors
Every third party that processes customer data, where, and under which agreement.
Last checked 26.10.2026 03:55
Sub-processors
| Provider | Purpose | Location | Agreement |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, database and object storage | Nuremberg & Falkenstein, Germany (EU) | Executed DPA |
| Mistral AI | Aria — in-product AI assistance: classification, evidence matching, risk drafting | Paris, France (EU) | Executed DPA |
| Upstash | Rate limiting and short-lived cache | AWS eu-central-1 — Frankfurt, Germany (EU) | Provider's standard DPA |
| Sentry (Functional Software, Inc.) | Application error and performance monitoring | Sentry EU region — Germany (EU) | Provider's standard DPA |
| PostHog, Inc. | Product analytics — only with your analytics-cookie consent | PostHog EU Cloud — Frankfurt, Germany (EU) | Provider's standard DPA |
| Plunk | Transactional email delivery | Hetzner, Germany (EU) · delivery via AWS SES (region unstated) | Provider's standard DPA |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Dublin, Ireland (EU) · USA (SCCs) | Executed DPA |
| Google Ireland Ltd. | Google sign-in, Google Analytics (consent-gated) and the Google Drive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) | Provider's standard DPA |
| Microsoft | Microsoft Entra ID sign-in and the SharePoint / OneDrive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) | Provider's standard DPA |
| GitHub | Evidence connector — read-only, only if an admin connects it | USA (SCCs) | Provider's standard DPA |
| Atlassian (Jira) | Evidence connector — read-only, only if an admin connects it | USA (SCCs) | Provider's standard DPA |
The full register, with the data each provider receives, is at /sub-processors.