Sub-processors
Last updated: 27 October 2026
Legal documents: Sub-processors
In short
- Board data is stored in Switzerland (Zurich). The application runs on servers in Germany (EU). Some providers, for AI features, email and SMS, are in the United States.
- We tell customers at least 30 days before adding a new sub-processor, and they can object.
1.Konsaro platform
These providers process Customer Data on our behalf to deliver the Konsaro Service. Each is bound by a data processing agreement with obligations equivalent to our Data Processing Agreement.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, file storage and authentication | All Customer Data | Switzerland (Zurich) |
| Hetzner Online GmbH | Hosting of the web application | Customer Data while the application processes it, server logs | Germany (EU) |
| OpenRouter, Inc. | Routing of AI requests with zero data retention, only when AI features are enabled | Content that users submit to AI features | EU endpoint (US company) |
| Anthropic (Claude models, via OpenRouter) | AI model processing, only when AI features are enabled | Content that users submit to AI features | Via OpenRouter's EU endpoint |
| Resend, Inc. | System emails and meeting invitations | Name, email address, email content | United States |
| Twilio Inc. | SMS one-time codes for two-factor authentication | Phone number, delivery metadata | United States |
The data processing agreements with these providers are shared as part of our security review. Email info@softwarevision.ch to request them. Organisation administrators can switch off AI features, in which case no content goes to OpenRouter or Google.
2.This website
The marketing website konsaro.com runs separately from the platform. No board data is processed on it.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of konsaro.com | Server logs, form submissions | Germany |
| Resend, Inc. | Email notifications for form submissions | Name, email address, message content | United States |
3.Changes
We announce new sub-processors to customers by email at least 30 days before they start processing Customer Data. Customers may object on reasonable data protection grounds, as set out in the Data Processing Agreement.
More information: Trust Center → Sub-processors