← Back to home
Sub-processor List
Last updated: July 2026
Vibranius uses the following third-party sub-processors to deliver our service. Sub-processors are subject to strict data protection agreements and access data only as necessary for their specific function. Your files, documents and business data are stored exclusively on your own dedicated server — they are only shared with a sub-processor when you explicitly use a feature that requires it (e.g. the AI assistant).
1. Overview
| Processor |
Purpose |
Region |
Legal basis |
| Hetzner Online GmbH |
Server hosting & storage |
EU (FI) |
Art. 28 DPA |
| Cloudflare, Inc. |
CDN, DNS, DDoS protection, e-mail routing |
EU/US — SCC |
SCC |
| Microsoft Azure |
AI language models (fast / vision / pro) |
EU region |
Art. 28 DPA |
| Google LLC |
AI language models (smart / genius — Gemini) |
EU/US — SCC |
SCC |
| Anthropic, PBC |
AI language model (Claude — orchestrator) |
US — SCC |
Legitimate interest |
| OpenRouter, Inc. |
AI routing layer (Mistral fallback, Gemini genius) |
US — SCC |
Legitimate interest |
| Mistral AI SAS |
AI language model (fallback) |
EU (FR) |
Art. 28 DPA |
| Resend, Inc. |
Transactional e-mail delivery |
US — SCC |
Art. 28 DPA |
Note on AI processing: Your documents and files are stored only on your dedicated server. Content is sent to an AI sub-processor only when you actively use the AI assistant feature. AI providers are contractually prohibited from using your data for model training.
2. Hetzner Online GmbH
- Role: Primary hosting provider. All client data (files, databases, application code) is stored on a dedicated physical server in Helsinki, Finland.
- Data processed: All data on your server — files, documents, databases, backups.
- Region: Helsinki, Finland (EU). Data does not leave the EU via Hetzner.
- Legal basis: Article 28 GDPR Data Processing Agreement (DPA). hetzner.com
3. Cloudflare, Inc.
- Role: DNS management, CDN (edge caching for public landing page), DDoS protection, and e-mail address routing.
- Data processed: IP addresses and HTTP metadata for visitors to the public website. E-mail envelope metadata for routing. No client business data.
- Region: Global (EU nodes available); US headquarters — Standard Contractual Clauses apply.
- Legal basis: SCC. cloudflare.com
4. Microsoft Azure (OpenAI Service)
- Role: AI language processing for fast-response, vision-capable, and professional-tier AI features.
- Data processed: Text and document content submitted to the AI assistant. Processed in EU Azure regions only.
- Region: EU (West Europe / Sweden Central). No transfer outside EU.
- Training: Microsoft Azure OpenAI does not use your prompts or completions to train models.
- Legal basis: Article 28 GDPR DPA. azure.microsoft.com
5. Google LLC (Gemini API)
- Role: AI language processing for smart and genius-tier AI features (Gemini 2.5 Flash / Pro).
- Data processed: Text and document content submitted to the AI assistant.
- Region: EU/US. Standard Contractual Clauses apply for non-EU processing.
- Training: Google does not use Gemini API inputs/outputs to train models without explicit opt-in.
- Legal basis: SCC. cloud.google.com
6. Anthropic, PBC
- Role: AI language model (Claude) used as an orchestrator for complex, multi-step AI tasks.
- Data processed: Text content submitted to the AI assistant for orchestration tasks.
- Region: US. Standard Contractual Clauses apply.
- Training: Anthropic's API terms prohibit using your data to train models.
- Legal basis: Legitimate interest + SCC. anthropic.com
7. OpenRouter, Inc.
- Role: AI routing layer. Used to route requests to Mistral AI (fallback) and Gemini genius-tier when accessed via the routing API.
- Data processed: Prompts forwarded to the selected underlying model provider.
- Region: US. Standard Contractual Clauses apply.
- Legal basis: Legitimate interest + SCC. openrouter.ai
8. Mistral AI SAS
- Role: AI language model used as a fallback when primary models are unavailable.
- Data processed: Text content submitted to the AI assistant, only when the fallback is triggered.
- Region: EU (France). No transfer outside EU.
- Training: Mistral AI does not train on API data by default.
- Legal basis: Article 28 GDPR DPA available. mistral.ai
9. Resend, Inc.
- Role: Transactional e-mail delivery (account verification, notifications, digests).
- Data processed: Recipient e-mail addresses and e-mail content for notifications sent by the platform.
- Region: US. Standard Contractual Clauses apply.
- Legal basis: Article 28 GDPR DPA. resend.com
10. What we do NOT use
- ❌ Advertising networks or tracking pixels
- ❌ Third-party analytics that collect personal data (Plausible is cookieless, no personal data)
- ❌ Selling or sharing your data with any third party for commercial purposes
- ❌ Using your content to train AI models
- ❌ Shared or multi-tenant servers — each client gets a dedicated machine
11. Questions?
For questions about sub-processors or data processing:
This list is updated quarterly or when sub-processor changes occur. For a Data Processing Agreement (DPA), see dpa.html.