Correction (2026-08-15). The contact address on this page was gyjong@gmail.com, a personal mailbox, from version 1.0.0 until this version. Requests under this document — including data-subject requests, sub-processor objections and DPA requests — now go to kenny@flenzies.com, the firm address. Nothing about the processing changed; only where the post arrives. Mail sent to the old address will continue to be read.
Sub-processors
EaaS uses a small, deliberately curated set of sub-processors to deliver the platform. Each sub-processor is bound by a Data Processing Agreement (DPA) and, where the destination is outside the European Economic Area (EEA), by an additional transfer mechanism — typically the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and where applicable the EU-US Data Privacy Framework.
We notify controllers at least 30 days in advance of adding or replacing a sub-processor. Controllers may subscribe to update notifications by emailing kenny@flenzies.com. Under Art. 28(2) GDPR, controllers may object to a proposed new sub-processor during the notice period; the procedure is described at the end of this page.
Change note — version 1.1.0 (2026-08-07). On 2026-08-01 the platform moved from a Vercel + Neon stack to a single self-operated server in Germany, and on 2026-08-04 the managed database was retired. Version 1.0.1 of this page described the old stack and remained published until 2026-08-07. This version corrects it: the hosting provider is now named, the two retired US providers are moved out of the active list, and three entries that were listed but never actually processed data are marked as such. No new category of processing was introduced by any of these changes — the net effect is fewer processors and less data leaving Germany.
Current sub-processor list
| # | Sub-processor | Role | Processing region | DPA | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | Hetzner Online GmbH (Germany) | Primary infrastructure. Hosts the application, the PostgreSQL database (including pgvector), and the encrypted backup snapshots. All tenant content and platform data resides here. | nbg1 — Nuremberg, Germany | hetzner.com/rechtliches/auftragsverarbeitung (Auftragsverarbeitungsvertrag, Art. 28 GDPR) | None required — provider and processing are both established in Germany (EEA). No Chapter V transfer occurs. |
| 2 | Clerk Inc. (United States) | Authentication, session management, user identity. Stores account-level identity records (email, name, session metadata). Does not receive tenant content. | United States | clerk.com/legal/dpa | SCCs per Clerk DPA |
| 3 | Anthropic PBC (United States) | LLM inference (Claude family). Default provider for agent reasoning and draft generation. Receives the prompt content of each agent run, which may include tenant content and the Gmail excerpts described in row 4. No training on customer data is contracted as the default Anthropic API setting. Tenants may opt to route inference to a self-hosted Ollama / vLLM endpoint instead, in which case Anthropic does not process the tenant's prompts at all. | United States | anthropic.com/legal/data-processing-addendum | EU SCCs Module 2 + 3 + UK Addendum + Swiss DP Laws per Anthropic DPA |
| 4 | Google LLC (United States / Ireland) | Gmail OAuth (read scope only) and Calendar API. EaaS stores only the OAuth access and refresh tokens, encrypted at application layer with AES-256-GCM. What is read from Gmail: thread metadata (subject, sender, recipients, timestamps), the Gmail-provided snippet, and the first 500 characters of the message body. These excerpts are not stored verbatim in our database, but they are included in the prompt sent to the inference provider in row 3, and material derived from them is persisted in the resulting briefing artefact. | United States / Ireland | cloud.google.com/terms/data-processing-addendum (Cloud DPA umbrella, applies to Workspace post-consolidation) | SCCs per Google Cloud DPA; EU-US Data Privacy Framework (Google is a certified participant) |
Being decommissioned — still holding data
These two are no longer part of the live service path described above. They are listed here, rather than removed, because they still hold personal data, and a processor that holds data must remain declared even when it no longer serves traffic. Decommissioning is in progress and this section will be removed once erasure is confirmed.
| Sub-processor | Former role | Status as of 2026-08-07 |
|---|---|---|
| Vercel Inc. (United States) | Application hosting and serverless function execution (fra1, Frankfurt) | Superseded on 2026-08-01 by the German host in row 1. Older deployments remain reachable and at least one automated path still reaches the database below; both are being shut down. Vercel Blob object storage was listed in version 1.0.1 but was never integrated and never held data. |
| Neon Inc. (United States, a Databricks company) | Managed PostgreSQL (eu-central-1, Frankfurt) | Superseded on 2026-08-04. A read-only audit on 2026-08-07 confirmed the project still contains records from the pre-migration period, including professional-contact records and two encrypted OAuth tokens, and that one automated identity-sync event reached it as recently as that morning. Scheduled for token revocation and full erasure. |
Configured but not in use
Declared for completeness. Each of these is present in the codebase but is not processing personal data in production today. Any of them entering service is a sub-processor change and triggers the 30-day notice in Art. 28(2).
| Provider | Intended role | Why it is not processing |
|---|---|---|
| Inngest Inc. (United States) | Background job orchestration for long-running agent runs | No credentials are configured on the production host; no job payload has been sent. No public DPA is published by Inngest — a private DPA would be executed before enabling it. |
| Resend Inc. (United States) | Outbound transactional email | Not enabled on the production host. The platform sends no email; invitations are issued as links the operator delivers personally. |
| EnrichLayer (Singapore), successor brand to Proxycurl (formerly Nubela Pte Ltd) | LinkedIn enrichment of public-record professional profiles | Not adopted. legal-02 recorded a NO-GO on this vendor. The integration runs in mock mode with no API key; no profile has ever been requested and no data has been sent to Singapore. Version 1.0.1 of this page listed it as an active sub-processor, which overstated our processing. |
Notes on processing regions
- All tenant content is resident in Germany. Application, database and backups run on Hetzner Cloud in Nuremberg (
nbg1), on a LUKS2 full-disk-encrypted volume. - Inference leaves the EEA by design. Prompt content — which may include tenant content and the Gmail excerpts described above — is transmitted to Anthropic in the United States under SCCs, unless the tenant routes inference to a self-hosted Ollama / vLLM endpoint.
- Republic of Korea. The current platform operator (Kenny Jung) is resident in the Republic of Korea and administers the server remotely. Korea benefits from the European Commission adequacy decision (Commission Implementing Decision (EU) 2022/254 of 17 December 2021), so transfers to Korea require no additional safeguard.
- United States. All US sub-processors are covered by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) per their respective DPAs. Where the sub-processor is certified under the EU-US Data Privacy Framework, that certification provides an additional safeguard.
How to object to a new sub-processor
Controllers may object to a proposed new sub-processor within the 30-day notice period, under Art. 28(2) GDPR. To object:
- Email kenny@flenzies.com with subject line
Sub-processor objection — [your tenant name], identifying the sub-processor you object to and the reason (a short statement is sufficient). - EaaS will respond within 5 working days with a proposed resolution: (a) confirm an alternative sub-processor for your tenant where technically feasible, (b) postpone the change for your tenant pending mutual agreement, or (c) where neither (a) nor (b) is feasible, allow your tenant to terminate the affected service in accordance with the Terms of Service and the executed DPA without penalty, with a pro-rata refund of any prepaid fees.
How to subscribe to update notifications
Email kenny@flenzies.com with subject line Subscribe — sub-processor updates. We maintain a notification list for controllers and other interested parties and notify before each material change to the sub-processor list.
Contact
kenny@flenzies.com EaaS — Kenny (Kwang-Yong) Jung Postal address pending German GmbH formation — Munich seat
This document is preparation material drafted for review by qualified German legal counsel. It is not legal advice. Kenny must engage a Munich-based Rechtsanwalt to confirm each sub-processor's current DPA terms, SCC implementation and adequacy posture before relying on this list in dealings with paying clients. Verify each linked DPA at the source before publishing.
Sub-processors · version 1.2.0 · effective 15 August 2026. This document is published by EaaS and reviewed periodically. For questions, contact kenny@flenzies.com.