Subprocessors and service providers
Last updated: 17 July 2026 · Part of the DPA where commissioned data is involved
Current providers
| Provider | Purpose/data | Location/safeguard |
|---|---|---|
| IONOS SE, Germany | Website, production/staging API infrastructure, network, system email and contact email | Germany; the selected EU/DE region must be maintained technically and contractually |
| Google Ireland Limited | Google Analytics 4, only after website consent; no commissioned data from the SaaS platform is intended | EU and possible processing in the USA; EU-US Data Privacy Framework/standard contractual clauses |
| Canva Pty Ltd / Canva group | Optional Canva integration connected by an administrator; OAuth, designs/templates and exports | Possible third-country processing under Canva terms; only after activation |
Self-hosted components
PostgreSQL, Redis, object storage/MinIO, Ollama and Open Design are self-hosted components in the current system architecture and are not separate external recipients. This applies only while they run on the infrastructure identified above and are not replaced by managed cloud services.
Providers not enabled by default
The code optionally supports external AI providers, particularly Anthropic and OpenAI, as well as other image providers. They are not part of the standard list unless enabled for the relevant tenant. Before production activation, the contract/DPA, data region, transfer basis, retention, training settings and customer information must be documented and this list updated.
Changes
DPA customers are informed at least 30 days before an intended material change. Objections based on data-protection grounds may be submitted within 14 days to info@televora.de.