Sub-processors
Last updated: June 1, 2026
How to read this page
A “sub-processor” is a third party that processes personal data on Transept’s behalf to deliver the service. Each row below is one such provider. For each we list: the role they play, the region where they process data, the data category they receive, the lawful basis for sharing that data, and the DPA in place.
Customers on paid plans can request our Data Processing Agreement at [email protected] — it incorporates the provider DPAs below as a flow-down.
Current sub-processors
| Provider | Role | Region | Data | Lawful basis | DPA |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting + Postgres database | Germany (EU) | All account data, documents, translations, glossaries, styleguides | Contract | Signed DPA — Hetzner standard DPA per § 28 GDPR |
| Stripe Payments Europe, Ltd. | Subscription billing + one-time purchases | Ireland (EU) for EU customers; US for non-EU | Billing email, billing country, amount, plan, last-four / brand of card. We never see full card numbers. | Contract | Auto-signed Stripe DPA via dashboard |
| Customer.io | Transactional + marketing email | EU workspace (api-eu.customer.io) | Email, locale, marketing-consent status, send/open/click events for the emails we send you | Contract (transactional) + consent (marketing) | Auto-signed Customer.io DPA via account settings |
| PostHog | Anonymous product analytics + error tracking | EU (eu.i.posthog.com) | Page views, feature usage events, device/browser metadata, exceptions. Only loaded with analytics consent. | Consent | Auto-signed PostHog DPA via organization settings |
| Anthropic, PBC | AI translation (Claude family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Anthropic API DPA, SCCs for EU-US transfers |
| OpenAI, LLC | AI translation (GPT family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | OpenAI API DPA, EU-US Data Privacy Framework + SCCs |
| Google LLC (Vertex AI + Gemini API) | AI translation (Gemini family) | EU regions available for Vertex AI; otherwise US | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Google Cloud DPA + EU-US Data Privacy Framework |
| Groq, Inc. | AI translation (Llama and other open-weight models) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Groq API DPA |
| OpenRouter, Inc. | AI gateway to additional models | United States | Translation prompts + responses; underlying provider varies | Contract | OpenRouter terms include processor obligations |
| Google LLC (Tag Manager + Google Ads) | Analytics + ad-conversion measurement | United States | Page-view metadata, click events, hashed email for enhanced conversions. Loaded only with consent, gated via Consent Mode v2. | Consent | Google Ads Data Processing Terms |
| Meta Platforms, Inc. | Ad-conversion measurement (Pixel + Conversions API) | United States | Conversion event metadata, hashed email + fbclid for click-to-conversion attribution. Loaded only with marketing consent. | Consent | Meta Business Tools Terms — Limited Data Use enabled for EU traffic |
Changes
Material changes (new sub-processor, change of region, addition of a new data category) are announced in advance on this page and on the Privacy Policy before they take effect for new processing. For paid customers, we also notify the account’s primary contact by email when a new sub-processor is added.