Annex 2: List of Subprocessors
We give notice of changes under Art. 5 of the DPA.
Always engaged
| Subprocessor | What it does | Where it processes | Transfer safeguard | Contract |
|---|---|---|---|---|
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | application and network operation, queues, support chat (Durable Objects), file storage (R2), receipt of emails logged via the copy (BCC) address | global network; R2 files in the EU | DPF, standard contractual clauses (SCC, Modules 2 and 3) in the DPA | the DPA is part of Cloudflare’s contractual terms (Self-Serve Subscription Agreement) |
| Databricks, Inc. (Neon service), 160 Spear Street, San Francisco, CA 94105, USA | database | EU (Frankfurt, AWS eu-central-1) | data in the EU; SCC in the DPA for access from outside the EU | the DPA is part of Neon’s contractual terms (Platform Terms and Databricks MCSA) |
| Plus Five Five, Inc. (Resend service), 2261 Market Street #5039, San Francisco, CA 94114, USA | sending emails: sign-in codes, follow-up reminders (contact name, company, follow-up text and due date), trial period notices | EU (Ireland, eu-west-1) | SCC in the DPA | DPA signed by the provider, concluded on account registration |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (Claude models) | AI help (the question and texts of Help articles), translation of messages in the support chat | USA (global routing); inputs and outputs are retained for up to 30 days | SCC (Modules 2 and 3) in the DPA, DPF | the DPA is part of Anthropic’s Commercial Terms |
| DeepL SE, Maarweg 165, 50825 Cologne, Germany | translation of shorter messages in the support chat (message text only). To be engaged once the contract is concluded; until then Anthropic translates | EU | data in the EU | the DPA is part of the DeepL Pro terms and is concluded with them |
Only when the Workspace turns on AI
| Subprocessor | What it does | Where it processes | Transfer safeguard | Contract |
|---|---|---|---|---|
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (Claude models) | reading career history from documents, AI answers, summaries for meeting preparation, suggested column mapping on import | USA (global routing); inputs and outputs are retained for up to 30 days | SCC (Modules 2 and 3) in the DPA, DPF | the DPA is part of Anthropic’s Commercial Terms |
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, and Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA (AWS Bedrock, Cohere Embed model via AWS Marketplace) | embeddings for semantic search (excerpts of documents, notes and messages, query text) | EU (Frankfurt, eu-central-1) | data in the EU; SCC in the AWS DPA | the AWS DPA is part of the AWS Service Terms |
Not on the list (for completeness)
- Google when signing in with a Google account: Google is an independent controller of the User’s account; we receive the name and email address from it. It is not a subprocessor.
- Stripe sells subscriptions and credits in its own name (Art. 4.6 of the Terms) and processes payment data as an independent controller. It does not receive Customer Data, only the Workspace Admin’s email address, the Workspace identifier and the number of seats.
- AI applications connected via MCP (Claude, ChatGPT and others): these are chosen by the Customer and its User and are not our subprocessors (Art. 5.5 of the DPA).
- Cloudflare Web Analytics measures traffic only on the website, not in the application.