Unterauftragsverarbeiter
Zuletzt aktualisiert: 30. September 2026
Wie diese Seite zu lesen ist
Ein „Unterauftragsverarbeiter“ ist ein Drittanbieter, der personenbezogene Daten im Auftrag von Transept verarbeitet, um den Dienst bereitzustellen. Jede Zeile unten steht für einen solchen Anbieter. Für jeden listen wir auf: die Rolle, die er spielt, die Region, in der er Daten verarbeitet, die Datenkategorie, die er erhält, die Rechtsgrundlage für die Weitergabe dieser Daten und den bestehenden AVV (Auftragsverarbeitungsvertrag).
Kunden in kostenpflichtigen Tarifen können unseren Auftragsverarbeitungsvertrag (AVV) unter support@transept.ai anfordern – er bindet die unten stehenden Anbieter-AVVs als Flow-down ein.
Aktuelle Unterauftragsverarbeiter
| Provider | Role | Region | Data | Lawful basis | DPA |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting + Postgres database | Germany (EU) | All account data, documents, translations, glossaries, styleguides | Contract | Signed DPA — Hetzner standard DPA per § 28 GDPR |
| netcup GmbH | Hosting for our self-run AI request monitoring (Langfuse) | Germany (EU) | Account ID and technical details of each AI request (model, timing, token counts, cost, errors). Prompt and output text is masked before it is recorded. | Legitimate interest (fault-finding and cost control) | netcup data-processing agreement per Art. 28 GDPR |
| Cloudflare, Inc. | DNS, content delivery and network proxy for transept.ai and app.transept.ai (TLS, DDoS protection) | Global edge network (the data centre nearest you) | IP address, request metadata and the content of requests and pages in transit | Legitimate interest (security and availability of the service) | Cloudflare Customer DPA, EU-US Data Privacy Framework + SCCs |
| Stripe Payments Europe, Ltd. | Subscription billing + one-time purchases | Ireland (EU) for EU customers; US for non-EU | Billing email, billing country, amount, plan, last-four / brand of card. We never see full card numbers. | Contract | Auto-signed Stripe DPA via dashboard |
| Customer.io | Transactional + marketing email | EU workspace (api-eu.customer.io) | Email, locale, marketing-consent status, send/open/click events for the emails we send you | Contract (transactional) + consent (marketing) | Auto-signed Customer.io DPA via account settings |
| PostHog | Product analytics + error tracking | EU (eu.i.posthog.com) | Browser, only with analytics consent: page views, feature usage, device/browser metadata, session recordings. Server: key in-app actions linked to your account ID, and server errors (pseudonymous without consent). Never document text. | Consent (browser) + legitimate interest (server) | Auto-signed PostHog DPA via organization settings |
| Anthropic, PBC | AI translation (Claude family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Anthropic API DPA, SCCs for EU-US transfers |
| OpenAI, LLC | AI translation (GPT family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | OpenAI API DPA, EU-US Data Privacy Framework + SCCs |
| Google LLC (Gemini API + Vertex AI) | AI translation and translation-memory search (Gemini family) | Google’s global endpoints, mainly United States | Translation prompts + responses (per request; paid API tiers, not used for training) | Contract (legitimate interest in service delivery) | Google Cloud DPA + EU-US Data Privacy Framework |
| Groq, Inc. | AI translation (Llama and other open-weight models) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Groq API DPA |
| OpenRouter, Inc. | AI gateway to additional models | United States | Translation prompts + responses; routed only to providers that do not store or train on the data | Contract | OpenRouter terms include processor obligations |
| Microsoft Corporation | Sign in with Microsoft (optional) | Global (Microsoft identity platform) | Name, email address and Microsoft account ID — only if you choose Microsoft sign-in | Contract | Microsoft Products and Services DPA |
| Figma, Inc. | Figma import (optional integration) | United States | Figma access tokens and the text of the Figma files you choose to import — only if you connect Figma | Contract | Figma Developer Terms; EU-US Data Privacy Framework |
| Google LLC (Tag Manager, Google Analytics, Google Ads) | Web analytics + ad-conversion measurement | United States | Page-view metadata, click events, hashed email for enhanced conversions (Google Ads only). Loaded only with consent, gated via Consent Mode v2. | Consent | Google Ads Data Processing Terms |
| Meta Platforms, Inc. | Ad-conversion measurement (Pixel + Conversions API) | United States | Conversion event metadata, hashed email + fbclid for click-to-conversion attribution. Loaded only with marketing consent. | Consent | Meta Business Tools Terms — Limited Data Use enabled for EU traffic |
Änderungen
Wesentliche Änderungen (neuer Unterauftragsverarbeiter, Wechsel der Region, Hinzufügen einer neuen Datenkategorie) werden im Voraus auf dieser Seite und in der Datenschutzerklärung angekündigt, bevor sie für neue Verarbeitungen wirksam werden. Bei zahlenden Kunden benachrichtigen wir außerdem den primären Kontakt des Kontos per E-Mail, wenn ein neuer Unterauftragsverarbeiter hinzugefügt wird.