1.Current sub-processors
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud servers, database, file storage and backups | All Customer Data | Nuremberg, Germany (EU) | Not needed (EU) |
| Cloudflare, Inc. | DNS, encrypted tunnel to our server, content delivery and protection against attacks; routing of e-mails sent to sales@ and [email protected] | All traffic to and from the Service; incoming e-mails to our addresses | Global network; company in the USA | EU-US Data Privacy Framework / Standard Contractual Clauses |
| Brevo | Delivery of service e-mails (invitations, password resets, setup links, notices) | Recipient e-mail address and name, message content | France (EU) | Not needed (EU) |
| Anthropic, PBC | AI model (Claude) for the assistant and the digital workers' column suggestions on Starter, Growth and free-trial Workspaces, and for Outturn support's operator agent | Questions asked in the assistant and the data excerpts retrieved to answer them; column headers of unrecognised files; operational information about Workspaces | USA | Standard Contractual Clauses (Anthropic's data processing addendum) |
2.Providers that are not sub-processors
- Lemon Squeezy sells self-serve Subscriptions as merchant of record and acts as an independent controller for the buyer's payment and billing data. It has no access to Workspace data.
- Systems you connect yourself (for example your Microsoft 365 or Google Workspace mailboxes, SFTP servers or APIs) are your own providers; Outturn reads from them on your instruction.
3.AI model providers
Anthropic is listed above in advance, as announced on this page. It processes no Customer Data until Outturn switches the AI model on, and not earlier than 30 days after this version of the list was published. Anthropic does not use the data it receives through Outturn to train its models.
4.Changes to this list
We announce any new or replaced sub-processor on this page and by e-mail to Workspace administrators at least 30 days before it starts processing Customer Data. Customers can object as set out in the Data Processing Agreement.