Draft pending legal review — last updated 2026-05-16. This document is a working draft published for transparency and has not yet been reviewed by qualified counsel.
Sub-processors
Sub-processors
Effective date: 2026-05-16
Your Office AI uses the following sub-processors to deliver the platform. Each is bound by a contract with GDPR-equivalent protections. We notify customers in advance of material changes.
Current list
| Sub-processor | Purpose | Data | Region | Transfer basis |
|---|---|---|---|---|
| Hetzner Cloud | Primary hosting, application servers, and ClickHouse telemetry host. | All application data, OTel logs and traces (PII scrubbed). | EU (Falkenstein / Helsinki) | EU-internal |
| Supabase | Managed PostgreSQL and object storage. | Identity, content, attachments | EU | EU-internal |
| Firebase (Google) | Product analytics and crash reporting. | Telemetry, crash logs | United States | Standard Contractual Clauses |
| LiveKit Cloud | Real-time audio, video, and transcription. | Audio, video, transcript text | United States / EU | Standard Contractual Clauses |
| OpenAI | Large language model inference. | Prompts and AI-routed content | United States | Standard Contractual Clauses |
| Anthropic | Large language model inference. | Prompts and AI-routed content | United States | Standard Contractual Clauses |
| Nango | OAuth proxy for third-party integrations. | OAuth refresh tokens, connector metadata | EU | EU-internal |
| Brave Search | Web search results for AI research mode. | Search queries | United States | Standard Contractual Clauses |
| Resend | Transactional email delivery. | Email address, message content | United States / EU | Standard Contractual Clauses |
Notification of changes
We will notify customers at least 30 days before adding or replacing a sub-processor that processes personal data. If you have an active Data Processing Agreement, you may object during that window. Notifications go to the email address on the workspace owner's account.
Stay informed
To receive sub-processor change notices by email, write to privacy@yoffice.ai. To request the executed Standard Contractual Clauses for any of the above, see the Data Processing Agreement page.