Sub-processors
Version 1.1 · 10 June 2026
Alvoru engages the following sub-processors to deliver our services. This list is updated with every addition or replacement, with at least 14 days' prior notice to existing customers.
Transparency: this list is publicly accessible. Object to a new sub-processor? Email within 14 days to info@alvoru.com.
Current sub-processors
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Anthropic | AI text generation (Claude) — primary AI for chatbot, classifier and summarisation | United States | SCCs + additional measures |
| Voyage AI | Vector embeddings for KB search (RAG) | United States | SCC (Model Clauses) + DPA — Privacy policy |
| OpenAI L.L.C. | AI text generation (GPT) — fallback if Anthropic is unavailable | United States | DPF + SCCs |
| Resend | Transactional email (customer and visitor mail) | United States | DPF-certified |
| Hetzner Online GmbH | Hosting & data storage (production and backup servers) | Germany / Finland (EU) | Within the EEA · ISO 27001 |
| Cloudflare Inc. | CDN, DDoS protection, DNS & Email Routing | Worldwide | DPF + SCCs |
| Mollie B.V. | Payment processing (from 1 June 2026) | Amsterdam (NL) | Within the EEA · PCI-DSS |
| Sentry GmbH | Error monitoring & application performance — detection and analysis of runtime errors in the dashboard. Data processed: technical logs (may incidentally contain PII in error context). Retention period 30 days. | Germany (EU) | Within the EEA · ISO 27001 |
| Meta Platforms Ireland Ltd | WhatsApp Business API — connecting the AI chatbot to the customer's WhatsApp channel (only if the customer activates this feature). Data processed: message content and end visitors' phone numbers. | Ireland (EU) — processing also in the US | SCCs + DPF |
| Google LLC | Google Workspace (mail routing for info@/contact@) and Google Maps Platform (public business data for lead prospecting via n8n). | United States | DPF + SCCs |
| Moneybird B.V. | Invoicing and accounting. Data processed: customer name, business details, invoice amounts, payment status. | Amsterdam (NL) | Within the EEA |
| n8n | Workflow automation for lead prospecting (self-hosted on Hetzner EU) | Germany (self-hosted) | Processing on our own EU server — no external transfer |
| Litestream | Continuous SQLite replication to Hetzner Storage Box (offsite backup) | Germany (Hetzner) | Data stays within the EU — stored on Hetzner Storage Box |
| AbuseIPDB | IP reputation check for bot protection (hashed IP only, no personal data) | United States | Legitimate interest (fraud prevention) — minimal data (IP only, anonymised for logging) |
Abbreviations
- SCCs = Standard Contractual Clauses (EU standard contractual clauses, Article 46 GDPR)
- DPF = EU-US Data Privacy Framework (adequacy decision)
- EEA = European Economic Area
- PCI-DSS = Payment Card Industry Data Security Standard
Tracking changes
All changes to this list are communicated by email to existing customers. Clients may object in writing within 14 days of the announcement; if the objection is well-founded, free-of-charge termination is possible.
Data Processing Agreement
The full legal terms for sub-processing are set out in the Data Processing Agreement (DPA), in accordance with Article 28 GDPR.
Contact
Questions about sub-processors, transfers outside the EEA or specific safeguards: info@alvoru.com.