Subprocessors
Last updated: July 2026
This page lists all third-party providers that may process personal data as subprocessors within the meaning of Art. 28 GDPR in connection with providing withmo. It supplements Annex 3 of our Data Processing Agreement and is kept up to date whenever changes occur.
Components we operate entirely ourselves (database, object storage, single sign-on) are not listed here, since no data is shared with a third party in those cases.
| Provider | Purpose | Processing Location | Transfer Basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting infrastructure | Falkenstein, Germany | Within the EU |
| Cloudflare, Inc. | Encrypted backup of object storage (Cloudflare R2) | USA | EU Standard Contractual Clauses |
| AssemblyAI, Inc. | Transcription and speaker recognition | Dublin, Ireland (EU) | Within the EU; DPA and EU Standard Contractual Clauses |
| Mistral AI SAS | AI-generated summaries, decision logs, suggested action items | France (EU) | Within the EU |
| Stripe Payments Europe, Ltd. | Payment processing | EU | Within the EU |
| Brevo SAS / Brevo GmbH | Transactional email delivery | France / Germany (EU) | Within the EU |
We notify business customers with a DPA in place of any new subprocessor at least 14 days in advance, per Section 7 of our Data Processing Agreement.