🇪🇺 EU First · Transparency
Sub-processors
Last updated 15 June 2026
Every provider that touches Depaza data, what they see, where they are, and the safeguard that covers them. The short version: your prompts, files and all AI processing stay with our EU infrastructure provider — the rest are narrow supporting services.
01The content path stays in the EU
Everything that contains your actual content — conversations, uploaded files, generated documents, AI inference (chat, vision, audio transcription) and model improvement — stays on EU infrastructure. Hosting, the database, file storage and backups run on Hetzner in Germany; AI inference and model improvement run on Scaleway in France. No provider outside the EU receives your conversations or files.
02Infrastructure and supporting sub-processors
| Provider | Role | Personal data involved | Location & safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting, database, file storage and backups — the depaza.com servers | Account data, conversation content, uploaded files | Germany (EU) — GDPR Art. 28 DPA |
| Scaleway SAS | AI inference — chat, document generation, vision and audio transcription — and model improvement | Conversation content and uploaded files sent for processing | France / EU regions — GDPR Art. 28 terms |
| Cloudflare, Inc. | CDN, TLS and DDoS protection in front of depaza.com | Traffic metadata; request content in transit (encrypted, served via EU edge) | US parent — EU-U.S. Data Privacy Framework + SCCs |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Name, email, payment details, billing history — never conversation content | Ireland (EU); transfers to Stripe, Inc. (US) under SCCs |
| SMTP2GO | Transactional email (magic links, notifications, receipts) | Email address and the content of system emails | New Zealand — EU adequacy decision |
| Tavily, Inc. | Global web-search fallback when EU search lacks coverage | Search query strings only — never conversations, files or your identity | United States — provider data-processing terms; avoidable by turning off web search |
03Tool-specific lookups
Some assistant tools query public data services with only the specific lookup terms they need — never your conversation: weather (Open-Meteo), currency rates (European Central Bank), Danish company registry (cvrapi.dk), Wikipedia, and domain availability (DNS and registry RDAP servers, which for some endings, like .com, are operated by US registries). Web search runs primarily on our own EU-hosted search index.
04Changes to this list
We give at least 30 days' notice before adding a sub-processor or materially changing one's role, by updating this page. If you want direct notice by email, tell us at [email protected] and we will add you to the notification list. Our standard DPA gives you the right to object on data protection grounds.
Questions about a provider on this list?
Email us — we answer sub-processor and security questions directly, no NDA required.
[email protected]