Subprocessors
This page lists every subprocessor we use to deliver our services — under Art. 28(2) GDPR and clause 12 of the service description.
As at 26 July 2026
| Company | Service | Place of processing |
|---|---|---|
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany |
Operation of application and database (hosting) | Data centre Helsinki, Finland European Union |
| Strato AG Otto-Ostrowski-Str. 7, 10249 Berlin, Germany |
Sending notification emails | Germany European Union |
| Stripe Payments Europe, Ltd. The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland — with involvement of Stripe, Inc., USA |
Payment processing and invoicing | Ireland (EU) and USA — see below |
Your register data does not leave the EU. The inventory of your AI systems, the risk classifications, the notifications and the quarterly records are processed exclusively in a data centre in Finland.
We use Stripe for payment processing. Only invoicing data goes there: company name, billing address, email address, VAT identification number, tier and amount. You enter your payment details directly with Stripe — we neither receive nor store them.
Stripe, Inc. in the United States is involved in this processing. The transfer is based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 1 and 2), which form part of the data processing agreement concluded with Stripe.
No entry from your AI register is transferred to Stripe.
What is not on this list — and why
We process no content data from your AI systems: no inputs, no outputs, no training or usage datasets. The customer portal holds only information about the systems in use — name, purpose, tier, responsible person, order of magnitude of consumption.
That is why this list is short. It contains no AI vendors, because we use no AI services that customer data flows into.
Changes to this list
Before we add or replace a subprocessor we inform our customers:
- Notice in text form at least four weeks before it takes effect
- Right to object on substantiated data protection grounds within two weeks of receipt
- Right to terminate if the service cannot reasonably be delivered without that provider
The details are set out in clause 6 of the data processing agreement (Annex 3).
Questions about this list
The contact for data protection matters is Franz Bauer, TÜV-certified data protection officer: aicostguard@itconsulting-fb.com
← Back to the start page