Sub-Processor List
All third parties that may process Customer personal data on Auro AI's behalf, as required by GDPR Article 28(2) and our Data Processing Agreement.
Last updated: 09 September 2026 · Version 1.0
Notification of changes. When we add or change a sub-processor we email all active customers at least 30 days before the change takes effect. You may object during the notice window; if we cannot accommodate the objection you may terminate with a pro-rata refund.
Infrastructure & hosting
| Sub-processor |
Service |
Location |
Transfer mechanism |
| Hetzner Online GmbH |
Web + database hosting (managed shared hosting + managed MySQL) |
Germany / Finland (EEA) |
EEA — no transfer mechanism needed |
| Cloudflare, Inc. |
CDN, WAF, DDoS protection, DNS |
EU edge nodes; corporate HQ US |
SCCs (Module 3) + Cloudflare DPA |
| Let's Encrypt (ISRG) |
TLS certificate issuance |
USA |
No personal data transferred (domain validation only) |
AI inference providers
| Sub-processor |
Service |
Location |
Transfer mechanism |
| Anthropic PBC |
Claude LLM API — customer-voice replies, AI staff member chat, tool-use orchestration. Anthropic does not train on API data per their commercial DPA. |
USA |
SCCs (Module 3) + Anthropic Commercial Terms + DPA |
| Amazon Web Services EMEA SARL |
Bedrock (Claude Sonnet 4.5) for strategic planning calls. Cross-region inference profile (eu-central-1 + us-east-1). |
EU (eu-central-1, Frankfurt) · partial US |
SCCs + AWS GDPR Addendum |
| Google LLC (Gemini API via AI Studio) |
Gemini Flash + Pro for cross-document synthesis, KB curator, meeting summarisation. Free-tier API; we do not send PII without prior pseudonymisation where feasible. |
USA |
SCCs + Google Cloud Data Processing & Security Terms |
| NVIDIA Corporation (NIM API) |
Llama-3.3 70B for inbox-message classification + 4 specialist drafts. Free tier; no training on API data per NVIDIA terms. |
USA |
SCCs + NVIDIA Cloud Services Agreement |
Communications & integrations (used only when the Customer connects them)
| Sub-processor |
Service |
Location |
Transfer mechanism |
| Twilio Ireland Ltd. |
SMS sending + receiving (Customer's outbound SMS to their own customers) |
Ireland (EEA) |
EEA processor · Twilio DPA |
| MessageBird N.V. |
SMS sending + receiving (alternative to Twilio) |
Netherlands (EEA) |
EEA processor · MessageBird DPA |
| Meta Platforms Ireland Ltd. |
WhatsApp Business API + Facebook Messenger + Instagram (where Customer connects) |
Ireland (EEA) · partial US |
SCCs + Meta Platform Terms |
| Recall.ai (Verbatim Inc.) |
Meeting bot for Zoom / Google Meet / Microsoft Teams transcription (Premium tier only). |
USA |
SCCs + Recall.ai DPA |
| Google LLC (Workspace OAuth) |
Gmail / Google Calendar / Google Drive integration when Customer connects |
USA |
SCCs + Google Workspace Terms |
| Microsoft Ireland Operations Ltd. |
Microsoft 365 (Outlook / Calendar / Teams) integration when Customer connects |
Ireland (EEA) · partial US |
SCCs + Microsoft Online Services DPA |
Payments & invoicing
| Sub-processor |
Service |
Location |
Transfer mechanism |
| Revolut Bank UAB |
Subscription billing + recurring payments processor |
Lithuania (EEA) |
EEA processor · Revolut Business DPA |
| Számlázz.hu (KBOSS Kft.) |
HU invoicing service (NAV-compliant invoice issuance + e-archive) |
Hungary (EEA) |
EEA processor · KBOSS DPA |
Email delivery
| Sub-processor |
Service |
Location |
Transfer mechanism |
| Hetzner SMTP relay |
Transactional email (account verification, password reset, system notifications) |
Germany (EEA) |
EEA — same provider as primary hosting |
Removed sub-processors (history)
No sub-processors have been removed since this list was first published.
Questions about a specific sub-processor or to request a copy of the SCCs in force, email [email protected].