Subprocessors
Complete list of all subprocessors pursuant to Art. 28(2) GDPR that process personal data within the Optimaite platform.
As of 3 September 2026 · Version 2.1 · As of: September 3, 2026 · Changes are communicated in advance pursuant to § 7 DPA.
Binding guarantees by Optimaite
- Optimaite stores primary customer data (databases, documents, files, search indexes and backups) in Germany on Optimaite-controlled infrastructure of Hetzner Online GmbH.
- Optimaite processes customer data exclusively in regions within the European Union or the European Economic Area. Any exception requires the controller's express, documented authorisation.
- Optimaite does not use customer content to train AI models and only engages AI providers that are contractually prevented from training on customer content.
- Provider-side retention, abuse monitoring and logging are disabled or reduced to the technically and legally necessary minimum.
- Document contents and client secrets do not enter diagnostic telemetry. Sentry is self-hosted on Optimaite-controlled Hetzner infrastructure in Germany and operates with effective data scrubbing.
- Access from a third country requires valid transfer safeguards under Art. 44 et seq. GDPR and a separate assessment of comparable secrecy protection under Section 43e(4) BRAO.
- Every subprocessor with possible access to client secrets is bound into the confidentiality chain under Section 43e(3) no. 3 BRAO and Section 203(4) StGB.
- Optimaite engages a provider for customer data only once the applicable data processing agreement and contractual evidence are in place.
Self-hosted components
Sentry and other internal platform components are operated by Optimaite on Optimaite-controlled Hetzner infrastructure in Germany. They are not independent recipients or additional external subprocessors.
Hetzner
Hetzner Online GmbH
Purpose
Hosting, Kubernetes, self-hosted databases, object storage and backups of the entire platform
Processed Data
All platform and customer data, including documents, matter and client content
Guarantees
Microsoft Azure AI
Microsoft Ireland Operations Limited
Purpose
AI inference through Azure AI Foundry and Azure OpenAI for user-selected AI functions
Processed Data
User-selected prompts, the required document excerpts and the generated outputs
Guarantees
AWS Bedrock
Amazon Web Services EMEA SARL
Purpose
AI inference through Amazon Bedrock for user-selected AI functions
Processed Data
User-selected prompts, the required document excerpts and the generated outputs
Guarantees
Google Cloud
Google Ireland Limited
Purpose
AI inference (Vertex AI), image generation and speech processing through Google Cloud
Processed Data
User-selected prompts, document excerpts, images, audio and the generated outputs
Guarantees
Mistral AI
Mistral AI SAS
Purpose
Optical character recognition (OCR) and document-related AI processing
Processed Data
Document pages submitted for recognition and the extracted text
Guarantees
Notes on Data Processing by AI Providers
Optimaite does not use customer content for general model training. Storage, logging, and abuse-monitoring rules depend on the selected service and agreement.
Processing locations and possible third-country access depend on the service. GDPR transfer safeguards do not replace the separate comparable-secrecy assessment under § 43e(4) BRAO.
Customers have the option to use their own API keys and thus control the processing chain themselves.