Legal · Sub-processors
Sub-processors of 2kw.ai
The third parties that process customer data on behalf of Manfred Kunze Development GmbH, what each one does, where it runs, and which agreement covers it. This list is Annex IV of the data processing agreement.
Last updated 2026-09-02 · Version 2026-09-02
Current sub-processors
Valid as of 2026-09-02. Four processors. The customer is informed in text form before a processor is added or replaced and can object, as set out in section 7 of the general terms and in clause 7.7 of the data processing agreement.
| Processor | Purpose | Data | Location and safeguards | Agreement |
|---|---|---|---|---|
| Microsoft Ireland Operations Limited One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Inference for the platform's built-in models and for the vision step of the document conversion pipeline (Azure OpenAI). | Prompts, document content and transcription audio submitted to built-in models, page images from document conversion, and the model output. | The built-in model deployment is of type Data Zone Standard with the resource in the Sweden Central region. For Data Zone deployments in an EU resource, Microsoft processes prompts and completions in EU member states only and keeps data at rest in the resource's geography. Microsoft's abuse-monitoring system may retain prompts and completions it flags for human review by Microsoft staff located in the EEA, stored in the resource's geography, unless modified abuse monitoring has been approved for the resource. Transfer: None intended. The Microsoft Products and Services Data Protection Addendum governs the processing. | Data processing terms Data, privacy and security for Azure OpenAI (Microsoft Learn) Deployment types and data zones (Microsoft Learn) |
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the application, the sign-in service, the document conversion services and the website analytics instance, and object storage (Hetzner Object Storage) for documents uploaded through the Files API or into knowledge bases. The platform database runs at Timescale (see below). | Documents uploaded for extraction, conversion or transcription while they are processed (held in memory, not stored); documents uploaded through the Files API or into knowledge bases, at rest in Hetzner Object Storage until they expire or are deleted; and every platform record while the application processes it: account data, schemas, prompts, results, usage records and traces. | Data centres in Falkenstein and Nuremberg, Germany. Hetzner Online GmbH operates an information security management system certified to ISO/IEC 27001:2022 by SOCOTEC Certification Deutschland GmbH; the certified scope covers all hosting services and data centres of Hetzner Online GmbH. Transfer: None. Processing stays in Germany. | Data processing terms Hetzner certification page |
| Timescale, Inc., d/b/a Tiger Data 335 Madison Ave, Floor 5, New York, NY 10017, United States | Managed PostgreSQL service (Tiger Cloud) hosting the platform database. | Every platform record at rest: account data, organisations and roles, schemas, prompts, extraction and conversion results, usage records, cost records and traces. Uploaded source files are not held in the database; it stores the extracted and converted results, knowledge-base passages and embeddings, and the metadata of stored files, not the files themselves. | The Amazon Web Services region eu-central-1 in Frankfurt, Germany, which we selected for the service. Tiger Cloud takes one full backup a week and incremental backups every day, plus continuous WAL archiving, in the same region (eu-central-1) and supports point-in-time recovery to any point in the last 14 days. No cross-region copy of the backups is kept. Transfer: Data stays in the Frankfurt region. The contracting entity is in the United States, so the Tiger Data Data Processing Addendum applies, which incorporates the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) and gives 7 days' notice of sub-processor changes. | Data processing terms Tiger Data list of sub-processors Tiger Cloud backup and recovery (docs) |
| Cloudflare, Inc. 101 Townsend Street, San Francisco, CA 94107, United States | Content delivery network, TLS termination and DDoS protection in front of 2kw.ai, app.2kw.ai and docs.2kw.ai. | IP addresses, connection and security data, request headers, and request and response bodies while in transit. | Cloudflare's global network; a request is handled at the point of presence closest to the visitor. Transfer: Cloudflare Customer Data Processing Addendum, which incorporates the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Modules Two and Three) for transfers outside the EU/EEA. | Data processing terms |
| Stripe Payments Europe, Limited The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland | Subscription billing, invoicing and payment processing for platform accounts through Stripe's hosted billing portal. | Billing contact, company name and address, VAT identification number, invoice history and payment method. Payment method details are collected and held by Stripe in its hosted portal and are not stored on our systems. | European Union, with Stripe entities in the United States involved in payment processing. For fraud prevention Stripe acts as an independent controller, as stated in its DPA. Transfer: Stripe Data Processing Agreement with its Data Transfer Addendum (EU standard contractual clauses) for transfers that require a transfer mechanism. | Data processing terms Stripe bank debit authorisation terms (names the entity's place of business) |
| Raintank Inc. dba Grafana Labs 165 Broadway, 23rd Floor, New York, NY 10006, United States | Hosted infrastructure monitoring (Grafana Cloud): cluster metrics, Kubernetes events and container logs from the production cluster. | Infrastructure metrics and container log lines. Application log lines can contain personal data such as e-mail addresses, IP addresses or account and organisation identifiers. Model prompts, completions and uploaded documents are not part of the logs. | Grafana Cloud stack in Grafana Labs' Germany region (AWS, prod-eu-west-2). Data is stored and processed in Germany. Transfer: None for the data location. The contracting entity is in the United States, so the Grafana Labs Data Processing Agreement applies, under which any transfer is governed by the EU standard contractual clauses. | Data processing terms Grafana Cloud regions (prod-eu-west-2 = AWS, Germany) Grafana Labs list of sub-processors |
Built-in models
The platform's built-in models run on one Azure OpenAI deployment of type Data Zone Standard with the resource in the Sweden Central region. Microsoft processes prompts and completions for Data Zone deployments only within the EU data zone and keeps data at rest in the resource's geography. Microsoft documents that Azure OpenAI prompts and completions are not used to train its models. Microsoft is therefore the only model sub-processor.
Bring-your-own-key providers
On the Scale and Enterprise plans a customer can route requests to a provider account of their own. Those requests go to the provider the customer selected, under that provider's terms and the customer's own contract with it. These providers are not sub-processors of Manfred Kunze Development GmbH:
- OpenAI
- Anthropic
- Azure OpenAI (the customer's own resource)
- Google Vertex AI
- Mistral
- Ollama (self-hosted by the customer)
Services we operate ourselves
The following components touch customer data but run on our own infrastructure at Hetzner, so no additional third party is involved:
- Sign-in service (auth.2kw.ai). Account registration, login, organisation membership and API key verification run on our own service inside the same cluster.
- Document conversion. PDF, Office, e-mail, image and CAD conversion runs on services we operate inside the cluster. The vision step of the conversion pipeline calls Azure OpenAI (see Microsoft above).
- Umami analytics. Website analytics for 2kw.ai run on our own Umami instance at umami.manfred-kunze.dev, inside the same cluster. No analytics provider receives visitor data.
Changes to this list
Additions and replacements are announced in text form to the contact address on the customer account before the change takes effect. A customer who objects on reasonable data protection grounds may terminate the affected service as described in the data processing agreement. Previous versions of this list are available on request via the contact form.
Related
Privacy noticeWhat the platform processes, where, on which legal basis, and for how long.Security overviewHosting, encryption, tenant isolation, access control and vulnerability reporting.Data processing agreementArticle 28 GDPR agreement based on the Commission's standard contractual clauses, with annexes.ProcurementCompany facts and every document a purchasing or compliance review asks for, on one page.