Last updated: 1 November 2026.
Sub-processors
This list describes the service providers used for Steinkauz Cloud. Where they process customer content on our behalf, we engage them as sub-processors under Article 28 GDPR. We announce changes to these sub-processors in accordance with the DPA. Payment and sign-in services may also act as independent controllers for their own processing; listing them alone does not establish a sub-processing relationship.
Model providers and gateways connected by you (BYOK / your own gateway) are not listed. They are your processors.
We operate authentication and consent management ourselves. The applications run on a server rented by us from Hetzner in Germany; the database operates as an external managed service at Neon.
Infrastructure and operations
| Entity | Purpose | Location / region | Third-country processing |
|---|---|---|---|
| Databricks, Inc. (Neon Postgres; under the current Neon terms) | Main database (accounts, organisations, encrypted content, billing references) | Frankfurt, Germany | Databricks DPA, section 8 and Annex B: SCCs for covered third-country transfers; incorporated through the online terms |
| Hetzner Online GmbH | Hosting of the self-operated applications | Falkenstein, Germany | DPA, section 3: contractual processing within the EU/EEA; third-country transfers only with prior consent and subject to Articles 44 et seq. GDPR |
Billing, messaging and sign-in
| Entity | Purpose | Location / region | Third-country processing |
|---|---|---|---|
| Stripe Payments Europe, Limited / Stripe Technology Europe, Limited (depending on the service under the agreement for Germany); Stripe, LLC (USA) | Payment processing, tax calculation, customer portal, invoice data; roles under the Stripe DPA | EU / USA; further international processing is possible under the DPA | Data Transfer Addendum: primarily DPF where applicable, otherwise SCCs; DPA and transfer addendum are incorporated through the online agreement |
| Plus Five Five, Inc. (Resend) | Transactional emails (confirmation, invitation, payment, withdrawal consent) | Primary processing in the USA under the DPA, section 6.1; configured sending region: Ireland | The DPA incorporated through the online terms specifies DPF and SCCs; an EU sending region does not promise exclusively European processing. |
| Google Ireland Limited (only when using “Sign in with Google”) | Optional sign-in service; Google processes Google account data under its own responsibility, and we process the received sign-in data for our user account | International processing under the Google Privacy Policy | Google specifies DPF and SCCs in its transfer information. Sign-in is not classified as sub-processing of our customer content. |
Measurement and product analytics
| Entity | Purpose | Location / region | Third-country processing |
|---|---|---|---|
| PostHog, Inc. | Product analytics, session replay (where active), LLM telemetry without prompt/response bodies | EU cloud | The DPA, section 10 also provides for processing outside the EU and specifies DPF and SCCs. |
Client-side and browser-related measurement takes place only with consent. Independently of this, server-side events from the Platform API and billing may be processed for operations, security and error analysis. These may include account, organisation, API key or transaction identifiers and model, usage, cost, runtime and error metadata; they are not necessarily anonymous. Prompt and response bodies are excluded from LLM telemetry. The Privacy Policy explains purposes and legal bases.
Notes
- Where processing on behalf of another party takes place, it is based on an agreement under Article 28 GDPR; the DPA applies to processing customer content.
- Categories: depending on the provider, master data, usage and billing data and/or content entered by the customer.
- We notify existing customers of intended changes to sub-processors in advance by email to the organisation contact on file, in accordance with the DPA.
- Further contractual documents: current Neon terms. Public provider documents do not replace evidence of the agreement applicable to our account.