All third parties that may process customer personal data on behalf of Auro AI (operated by Evosolve Kft.), as required by GDPR Article 28(2) and our Data Processing Agreement. Transfers to providers outside the EEA rely on the EU–US Data Privacy Framework where the provider is certified, and on the EU Standard Contractual Clauses (SCCs) otherwise; the specific mechanism in force for a given provider is available on request.
Notification of changes. When we add or change a sub-processor we email all active customers at least 30 days before the change takes effect. You may object during the notice window; if we cannot accommodate the objection you may terminate with a pro-rata refund.
Infrastructure & hosting
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Web + database hosting (managed shared hosting + managed MySQL) | Germany / Finland (EEA) | EEA — no transfer mechanism needed |
| Cloudflare, Inc. | CDN, WAF, DDoS protection, DNS | EU edge nodes; corporate HQ US | SCCs (Module 3) + Cloudflare DPA |
| Let's Encrypt (ISRG) | TLS certificate issuance | USA | No personal data transferred (domain validation only) |
AI inference providers
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Anthropic PBC | Claude LLM API — customer-voice replies, AI staff member chat, tool-use orchestration. Anthropic does not train on API data per their commercial terms. | USA | SCCs + Anthropic Commercial Terms & DPA |
| Amazon Web Services EMEA SARL | Bedrock (Claude) for a subset of strategic-planning calls. Cross-region inference profile (eu-central-1 + us-east-1). | EU (Frankfurt) · partial US | SCCs + AWS GDPR Addendum |
| Google LLC (Gemini API) | Gemini Flash + Pro for cross-document synthesis, KB curation, meeting summarisation. We avoid sending PII without pseudonymisation where feasible. | USA | SCCs + Google Cloud Data Processing & Security Terms |
| NVIDIA Corporation (NIM API) | Llama-3.3 70B for inbox-message classification + specialist drafts. No training on API data per NVIDIA terms. | USA | SCCs + NVIDIA Cloud Services Agreement |
Communications & integrations (engaged only when the customer connects them)
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Twilio Ireland Ltd. | SMS sending + receiving (the customer’s outbound SMS to their own customers) | Ireland (EEA) | EEA processor · Twilio DPA |
| Meta Platforms Ireland Ltd. | WhatsApp Business API + Facebook + Instagram (where the customer connects) | Ireland (EEA) · partial US | SCCs + Meta Platform Terms |
| Google LLC (Workspace OAuth) | Gmail / Google Calendar / Google Drive integration when the customer connects | USA | SCCs + Google Workspace Terms |
| Microsoft Ireland Operations Ltd. | Microsoft 365 (Outlook / Calendar / Teams) integration when the customer connects | Ireland (EEA) · partial US | SCCs + Microsoft Online Services DPA |
| LinkedIn Ireland Unlimited Company | Social publishing when the customer connects | Ireland (EEA) · partial US | SCCs + LinkedIn terms |
Payments & invoicing
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Revolut Bank UAB | Subscription billing + recurring payments processor | Lithuania (EEA) | EEA processor · Revolut Business DPA |
| Számlázz.hu (KBOSS Kft.) | HU invoicing service (NAV-compliant invoice issuance + e-archive) | Hungary (EEA) | EEA processor · KBOSS DPA |
Email delivery
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Hetzner SMTP relay | Transactional email (account verification, password reset, system notifications) | Germany (EEA) | EEA — same provider as primary hosting |
Removed sub-processors (history)
Chatbase (legacy embedded chat widget) — removed 2026-07. Auro now runs its own first-party chat widget on EU infrastructure; the widget’s AI uses Anthropic, listed above.