Complete list of all subprocessors pursuant to Art. 28(2) GDPR that process personal data within the Optimaite platform.
As of: March 5, 2026 · Changes are communicated in advance pursuant to § 7 DPA.
Hetzner Online GmbH
Purpose
Cloud infrastructure, Kubernetes cluster, S3-compatible object storage
Processed Data
All application data (documents, user data, metadata)
Guarantees
Neon Inc.
Purpose
Serverless PostgreSQL database (primary application database)
Processed Data
Structured application data (user accounts, document metadata, configurations)
Guarantees
Microsoft Ireland Operations Limited
Purpose
AI model API for text processing, document analysis, and generation
Processed Data
Document contents and user queries (processing only, no storage)
Guarantees
Amazon Web Services EMEA SARL
Purpose
AI model API (Claude) for text processing and reasoning
Processed Data
Document contents and user queries (processing only, no storage)
Guarantees
Google Ireland Limited
Purpose
OCR and document recognition (Document AI)
Processed Data
Document images and scanned PDFs (processing only, no storage)
Guarantees
Vercel Inc.
Purpose
Website hosting, Edge Functions, CDN
Processed Data
Website requests, IP addresses, performance metrics
Guarantees
Stripe Payments Europe Ltd.
Purpose
Payment processing and invoicing
Processed Data
Invoice data, payment information, email addresses
Guarantees
Mailgun Technologies Inc.
Purpose
Transactional email delivery (notifications, invitations)
Processed Data
Email addresses, message contents, delivery logs
Guarantees
Functional Software Inc.
Purpose
Error monitoring, performance monitoring, crash reporting
Processed Data
Error logs, stack traces, device information (pseudonymized)
Guarantees
LangChain Inc.
Purpose
AI observability, tracing, and quality assurance of LLM calls
Processed Data
AI requests and responses (pseudonymized), latency and error data
Guarantees
The AI services (Azure AI Foundry, AWS Bedrock) process document contents exclusively within the EU to answer API requests. Contractual zero-retention agreements are in place: input data is immediately discarded after processing and is neither stored nor used for model training.
All AI processing takes place in EU data centers (Azure Germany West, AWS Frankfurt). No data transfers to third countries occur as part of AI processing.
Customers have the option to use their own API keys and thus control the processing chain themselves.