Subprocessors
These are the providers that process personal data on our behalf under Art. 28 GDPR. This page is generated from the same source as the subprocessor section of our Privacy Policy, so the two can never state different providers.
Last updated: 5 August 2026
Template text pending review by qualified German counsel.
| Provider | Purpose | Processing location | Transfer mechanism (Art. 46) | Data processing agreement (Art. 28) |
|---|---|---|---|---|
| OpenAI | LLM extraction, classification and anomaly detection | United States | EU Standard Contractual Clauses (2021/914) via the OpenAI DPA | signed |
| Mistral | OCR and bounding-box extraction | EU (eu-west-3) | Not applicable — EU processing | signed |
| Railway | Application hosting (api, worker, publisher) | EU | Not applicable — EU processing | signed |
| Neon | PostgreSQL database hosting | EU (Frankfurt, eu-central-1) | Not applicable — EU processing | signed |
| Vercel | Frontend hosting | EU (fra1) | Not applicable — EU processing | signed |
| Upstash | Rate limiting and task broker | EU (eu-west-1) | Not applicable — EU processing | signed |
| Resend | Transactional email | United States | EU Standard Contractual Clauses (2021/914) via the Resend DPA | signed |
| Stripe | Subscription billing | United States | EU-U.S. Data Privacy Framework (certified), with EU Standard Contractual Clauses (2021/914) incorporated as fallback via Stripe's Data Transfers Addendum | signed |
| Cloudflare | Abuse prevention (Turnstile) and object storage (R2) for workflow documents | United States | EU Standard Contractual Clauses (2021/914) via the Cloudflare Customer DPA | signed |
| Sentry | Backend error monitoring (send_default_pii disabled) | EU (Frankfurt) event storage, with some US-based subprocessors (Twilio/SendGrid, Intercom) | EU-U.S. Data Privacy Framework (Sentry certified), with EU Standard Contractual Clauses (2021/914) incorporated as fallback via Sentry's DPA — also covers onward transfers to Sentry's non-EU subprocessors (Twilio/SendGrid, Intercom) despite EU-region event storage | signed |
We will notify customers by email before a new subprocessor starts processing personal data, so that an objection can be raised before the change takes effect.
For questions about our use of subprocessors, contact contact@parsurai.com.