SUB-PROCESSORS
Last updated October 31, 2026
This page lists the processors and sub-processors used by Studio 073X e.K. (AETOP.). Purposes and locations follow the Privacy Policy and the Data Processing Agreement.
Processor: we are the controller (for example for this website, invoicing, and our own operations). Sub-processor: we engage the company when we process personal data on behalf of a client under the DPA. Some companies are both.
Independent controller: the company processes the data for its own purposes and under its own responsibility; it is not our processor.
A dash (—) means no public document is available.
Sub-processors
| Company | Location | Role | Purpose | DPA | Sub-processor list |
|---|---|---|---|---|---|
| Anthropic (Claude) | USA | Processor and sub-processor | AI assistance for drafting, summarizing, and software development; AI model inference | DPA | Sub-processor list |
| Anysphere, Inc. (Cursor), San Francisco, USA | USA | Processor and sub-processor | Software development and marketing | DPA | Sub-processor list |
| Cloudflare, Inc. | USA / global network | Processor and sub-processor | DNS, TLS, and network security for our domains and some internal services; network proxy and security in front of the service | DPA | Sub-processor list |
| Google Ireland Ltd. / Google LLC | EU / USA | Processor and sub-processor | Website analytics (Google Analytics 4); email, calendar, documents, and file exchange (Google Workspace) | DPA · GA4 DPA | Sub-processor list · GA4 sub-processors |
| Hetzner Online GmbH, Gunzenhausen | Germany | Processor and sub-processor | Cloud servers and object storage for the Spectacle backend and the Spectacle client dashboard; self-hosted DocuSeal for contract signing | DPA | Sub-processor list |
| OpenAI | USA | Processor and sub-processor | AI assistance for drafting, summarizing, and software development; AI model inference | DPA | Sub-processor list |
| OpenRouter, Inc., New York, USA | USA | Processor and sub-processor | Software development, marketing, and contract administration; personal data limited to contract and business contact data (e.g., name, company, business email address). Where a client has agreed in its contract, routing of AI model requests to the selected model provider, via the OpenRouter account held by Studio 073X. | DPA | Sub-processor list |
| Schwarz Digits Cloud GmbH & Co. KG (STACKIT), Bad Friedrichshall | Germany (region eu01) | Processor and sub-processor | AI model inference and secrets management | DPA | sub-processors: Annex 2 of the AVV |
Service providers for our own processing (Studio 073X as controller)
These providers do not process client data on our clients' behalf.
| Company | Location | Role | Purpose | DPA | Sub-processor list |
|---|---|---|---|---|---|
| ZenLeads, Inc. d/b/a Apollo.io, Covina, CA | USA | Independent controller (not our processor) | Identification of visiting companies for B2B marketing (website tracker); business contact data and enrichment for our B2B outreach | DPA (roles) | Privacy Policy |
| Notion Labs, Inc. | USA | Processor | CRM and contact management for our clients and leads (name, email address, LinkedIn URL, company), project management, client portal (AETOP OS) without client content | DPA | Sub-processor list |
| PostHog Inc. (EU Cloud) | EU (data hosted in the EU) | Processor | Website analytics on www.aetop.co | DPA | Sub-processor list |
| Qonto SA (formerly OLINDA SAS), Paris, France, acting in Germany through Qonto Zweigniederlassung Deutschland, Berlin | EU, with storage on Amazon AWS in France and Germany per Qonto's Privacy Policy. Transfers outside the EU only on an adequacy decision or Standard Contractual Clauses | Invoicing: role not specified in Qonto's contract documents; clarification requested from Qonto. Card acceptance: processor (Schedule 1, Payment Processing Services Terms). Payment account and incoming SEPA transfers: independent controller, including for its own legal obligations (anti-money laundering, fraud prevention). | Creating our invoices (client name, email address, billing address); card acceptance (Cardholder Personal Data, payment transaction data); business payment account and incoming SEPA transfers (client name, IBAN and bank name, payment transaction data) | DPA (card acceptance) · Privacy Policy | No public sub-processor list |
| Resend (Plus Five Five, Inc.) | USA | Processor | Transactional email: form confirmations, contract and invoice emails | DPA | Sub-processor list |
| Slack Technologies | USA | Processor | Internal team notifications (e.g., new inquiries) and internal team communication | DPA | Sub-processor list |
| Tailscale Inc. | USA | Processor | Private network connections between our own devices and servers | DPA | Sub-processor list |
| Vercel Inc. | USA / EU edge | Processor | Hosting and edge delivery of our website www.aetop.co, privacy-friendly performance metrics, storage of form submissions | DPA | Sub-processor list |