調達・購買担当者向け✦
サブプロセッサー一覧
最終更新日：2026年9月30日
本ページの読み方
「サブプロセッサー」とは、Transeptに代わって本サービスを提供するために個人データを処理する第三者を指します。以下の各行は該当するプロバイダーを示しています。各プロバイダーについて、担う役割、データ処理を行う地域、受領するデータのカテゴリ、データ共有の適法根拠、および締結されているデータ処理契約（DPA）を記載しています。
有料プランをご利用のお客様は、[email protected]にて当社のデータ処理契約（DPA）をご請求いただけます。本契約には、以下の各プロバイダーとのDPAが下位委託条件（flow-down）として組み込まれています。
現在のサブプロセッサー
| Provider | Role | Region | Data | Lawful basis | DPA |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting + Postgres database | Germany (EU) | All account data, documents, translations, glossaries, styleguides | Contract | Signed DPA — Hetzner standard DPA per § 28 GDPR |
| netcup GmbH | Hosting for our self-run AI request monitoring (Langfuse) | Germany (EU) | Account ID and technical details of each AI request (model, timing, token counts, cost, errors). Prompt and output text is masked before it is recorded. | Legitimate interest (fault-finding and cost control) | netcup data-processing agreement per Art. 28 GDPR |
| Cloudflare, Inc. | DNS, content delivery and network proxy for transept.ai and app.transept.ai (TLS, DDoS protection) | Global edge network (the data centre nearest you) | IP address, request metadata and the content of requests and pages in transit | Legitimate interest (security and availability of the service) | Cloudflare Customer DPA, EU-US Data Privacy Framework + SCCs |
| Stripe Payments Europe, Ltd. | Subscription billing + one-time purchases | Ireland (EU) for EU customers; US for non-EU | Billing email, billing country, amount, plan, last-four / brand of card. We never see full card numbers. | Contract | Auto-signed Stripe DPA via dashboard |
| Customer.io | Transactional + marketing email | EU workspace (api-eu.customer.io) | Email, locale, marketing-consent status, send/open/click events for the emails we send you | Contract (transactional) + consent (marketing) | Auto-signed Customer.io DPA via account settings |
| PostHog | Product analytics + error tracking | EU (eu.i.posthog.com) | Browser, only with analytics consent: page views, feature usage, device/browser metadata, session recordings. Server: key in-app actions linked to your account ID, and server errors (pseudonymous without consent). Never document text. | Consent (browser) + legitimate interest (server) | Auto-signed PostHog DPA via organization settings |
| Anthropic, PBC | AI translation (Claude family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Anthropic API DPA, SCCs for EU-US transfers |
| OpenAI, LLC | AI translation (GPT family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | OpenAI API DPA, EU-US Data Privacy Framework + SCCs |
| Google LLC (Gemini API + Vertex AI) | AI translation and translation-memory search (Gemini family) | Google’s global endpoints, mainly United States | Translation prompts + responses (per request; paid API tiers, not used for training) | Contract (legitimate interest in service delivery) | Google Cloud DPA + EU-US Data Privacy Framework |
| Groq, Inc. | AI translation (Llama and other open-weight models) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Groq API DPA |
| OpenRouter, Inc. | AI gateway to additional models | United States | Translation prompts + responses; routed only to providers that do not store or train on the data | Contract | OpenRouter terms include processor obligations |
| Microsoft Corporation | Sign in with Microsoft (optional) | Global (Microsoft identity platform) | Name, email address and Microsoft account ID — only if you choose Microsoft sign-in | Contract | Microsoft Products and Services DPA |
| Figma, Inc. | Figma import (optional integration) | United States | Figma access tokens and the text of the Figma files you choose to import — only if you connect Figma | Contract | Figma Developer Terms; EU-US Data Privacy Framework |
| Google LLC (Tag Manager, Google Analytics, Google Ads) | Web analytics + ad-conversion measurement | United States | Page-view metadata, click events, hashed email for enhanced conversions (Google Ads only). Loaded only with consent, gated via Consent Mode v2. | Consent | Google Ads Data Processing Terms |
| Meta Platforms, Inc. | Ad-conversion measurement (Pixel + Conversions API) | United States | Conversion event metadata, hashed email + fbclid for click-to-conversion attribution. Loaded only with marketing consent. | Consent | Meta Business Tools Terms — Limited Data Use enabled for EU traffic |
変更について
重大な変更（新たなサブプロセッサーの追加、地域の変更、新しいデータカテゴリの追加）がある場合は、新たな処理に対して有効となる前に、本ページおよびプライバシーポリシーにて事前にお知らせします。有料プランをご利用のお客様には、新たなサブプロセッサーが追加された際、アカウントの主たる連絡先宛てにメールでも通知いたします。