Subprocessors
These providers process personal data on our behalf (Art. 28 GDPR). We update this list before a new subprocessor goes into production.
Last updated: 5 August 2026
| Provider | Purpose | Location / processing | Basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure (application, database, file storage) | Germany | DPA · processed exclusively in the EU |
| Scaleway SAS | AI inference, embeddings for AI search, and storage of the encrypted database backups | France (Paris) | DPA · processed in the EU · zero data retention: inputs and outputs are not stored · backups are encrypted before transfer, Scaleway cannot read them |
| Amazon Web Services EMEA SARL | AI inference for replies and drafts via Amazon Bedrock. Complements Scaleway, does not replace it – the embeddings for AI search stay with Scaleway. | EU member states only: Frankfurt, Paris, Dublin, Stockholm, Milan, Aragón. We enforce the binding to the EU technically via EU inference profiles. | AWS Data Processing Addendum incl. standard contractual clauses (part of the AWS Service Terms) · zero data retention: inputs and outputs are neither stored nor passed on to the model provider · no training |
| Mailjet (Sinch Email) | Sending inbrix system email (invitations, notifications). Not your customers' support email. | France | DPA · processed in the EU |
| Stripe Payments Europe, Ltd. | Payment processing for inbrix subscriptions (credit card, SEPA direct debit), invoicing and payment receipts. Processed are the billing and payment data of customers (organisations) – not the support data of their end customers. | Ireland (Dublin) · processed in the EU; EU Standard Contractual Clauses apply to transfers to Stripe, Inc. (USA) | DPA (Stripe Data Processing Agreement) · Standard Contractual Clauses |
| PostHog, Inc. | Pseudonymised website and product analytics (usage measurement, heatmaps, performance) – cookieless unless you consent | US company · processing exclusively in the EU cloud (Frankfurt) | DPA · standard contractual clauses · EU cloud · anonymous; persistent storage only with your consent |
Not on this list
Our error monitoring is self-hosted – no telemetry goes to an external service. Every remaining component runs on our own infrastructure at Hetzner; beyond the providers listed above, no one else is involved.
Changes
We announce the use of a new subprocessor at least 30 days in advance, actively by email to the organisation's administrators – with provider, purpose, location and date. You may object to the change within this period. Questions: datenschutz@golle-it.de.