As of: 23.10.2026 Processor: Sat-iTec Systemhaus GmbH Platform: ChatiTec
Before content is transmitted to external AI providers, personal data and professional secrets are automatically anonymised (PII tokenisation). This anonymisation is enforced by default (PII_FORCE_FOR_EXTERNAL=true). Consequently, exclusively anonymised content without identifying plain-text personal data is transmitted to the external sub-processors listed below. Re-mapping of the placeholders is only possible locally (Fernet-encrypted) on the German infrastructure.
Transfer-free alternative: When purely local models (Ollama/vLLM) are used, no external sub-processors are engaged; there is no data transfer to third parties and no transfer to third countries.
| No. | Sub-processor | Purpose of processing | Data processed | Location / third country | Transfer mechanism (Chapter V GDPR) |
|---|---|---|---|---|---|
| 1 | OpenAI OpenAI Ireland Ltd. (for customers in the EEA) | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
| 2 | Anthropic Anthropic Ireland, Limited (for customers in the EEA) | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
| 3 | Google (Gemini) Google Ireland Ltd. | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
Note on the transfer mechanism: The decisive factor is the contractual basis of the specific provider in force at the relevant time. For US providers, the EU standard contractual clauses pursuant to Implementing Decision (EU) 2021/914 are primarily relevant; where the provider is certified under the EU-US Data Privacy Framework and an adequacy decision is applicable, this may also be relied upon. Whether this information is up to date is to be reviewed regularly.
| Provider | Status | Reason |
|---|---|---|
| DeepSeek | DEACTIVATED by default | Third-country/risk assessment China; cannot be used without an express, separate risk assessment and activation |
| No. | Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|---|
| 4 | Sat-iTec Systemhaus GmbH – own data centre Augsburg | Hosting, housing, physical data centre operation | Germany / EU | No transfer to third countries; DPA pursuant to Art. 28 GDPR |
| 5 | Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland | Processing of payments for paid plans | Ireland (EU); transmission to Stripe, Inc. (USA) possible | Stripe acts as an independent controller for payment processing; no content data. Third-country transfer on the basis of the EU-U.S. Data Privacy Framework or the EU standard contractual clauses |
| 6 | Internet Security Research Group (Let's Encrypt), San Francisco, USA | Issuance of TLS certificates (no content data) | USA | No processing of personal content data; technical domain validation only |
Changes to this list (engagement/replacement of sub-processors) will be notified to the controller in good time in advance in text form in accordance with § 5 of the Data Processing Agreement; the controller has the right to object provided for therein.
As of: 23.10.2026