Subprocessors

The short version. These are the companies that handle customer data for us. Our servers are in the EU, but some of these companies work in the US, so your data does not stay only in the EU. We give 30 days' notice before adding a new one.

Hosting

Company	What for	Data	Where	Safeguard
Hetzner Online GmbH	Our servers: database, files, mail server, meetings, transcription	All Customer Data	EU (Germany or Finland)	inside the EU
Cloudflare, Inc.	DNS for codingcords.com	Domain names; the IP addresses of DNS lookups	worldwide network, US company	Data Privacy Framework, SCCs

Mail runs on our own mail server (Stalwart), meetings on our own media server (LiveKit), and transcription, voice and picture models on our own servers. All of these are at Hetzner.

AI

Company	What for	Data	Where	Safeguard
OpenRouter, Inc.	Routes each AI request to a model provider. Every request asks to use only providers that do not train on data or keep it.	Prompts and the content sent to Cord or an AI feature	US	SCCs
Google LLC (Vertex AI) or Amazon Web Services (Bedrock), through OpenRouter	Run Anthropic's Claude Haiku for Cord's answers, summaries, drafts and meeting notes. Anthropic's own service is not used, because it does not offer zero retention through OpenRouter.	the same, per request	US	Data Privacy Framework, SCCs
Google LLC (through OpenRouter)	Gemini embeddings, so search can find things by meaning	text of indexed content	US	Data Privacy Framework, SCCs
TypeSafe AI (through OpenRouter)	The Jev decision model: sorting mail replies and choosing suggestions	text of the item being sorted	through OpenRouter; we are confirming the region and will update this row	SCCs

Audio from meetings, calls and dictation does not go to these companies; it is transcribed on our own servers.

Communications

Company	What for	Data	Where	Safeguard
Telnyx LLC	Phone numbers, calls, texts, call routing	phone numbers, call and message records, call audio in transit, text content	US, with points of presence in the EU	SCCs

Payments

Company	Role	Data	Where	Safeguard
Lemon Squeezy LLC (a Stripe company)	Merchant of record: checkout, tax, invoices, refunds	billing contact, company, payment details (we never see cards)	US	an independent controller of payment data; Data Privacy Framework, SCCs

Our own team

Our team works from Pakistan and can reach Customer Data to run and support the service, under the Standard Contractual Clauses described in the DPA.

Features you turn on

Importing mail from another provider, or connecting another service, sends data to that service at your request; it acts under its own terms.

Notice of changes

We tell workspace owners by email at least 30 days before we add a subprocessor, and update this page. To object, or to ask to be told too, write to privacy@codingcords.com.