Legal · GDPR Art. 28
Sub-processors
Last updated: 2026-03-27
Legal · GDPR Art. 28
Last updated: 2026-03-27
Current Sub-processors
| Provider | Role | Location | Privacy / DPA |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure and hosting | Helsinki, Finland (EU) | hetzner.com |
| Stripe, Inc. | Payment processing | United States | stripe.com/privacy |
| Anthropic, PBC | AI inference | United States | DPA · SCCs incorporated · SOC 2 audited annually |
All sub-processors are bound by data processing agreements that require them to protect personal data and process it only as instructed by Vodr.
Note for EU customers: Anthropic processes data in the United States. Transfer is governed by EU Standard Contractual Clauses (SCCs) and the UK Addendum. EU customers requiring a Transfer Impact Assessment (TIA) before accepting a US-based sub-processor should contact privacy@vodr.ai.
International Transfers
Hetzner: Data processed within the EU. No international transfer.
Stripe: Data transferred to the United States under Standard Contractual Clauses (SCCs) approved by the European Commission.
Anthropic: Data transferred to the United States under EU SCCs and the UK Addendum. Anthropic's DPA is automatically incorporated into their Commercial Terms of Service — no separate signing required. Anthropic commits to processing Customer Personal Data only to provide the Services and not to sell, share, or use data outside the direct business relationship. Anthropic notifies customers within 48 hours of a security breach and is audited annually against SOC 2. Anthropic's sub-processor list: anthropic.com/subprocessors.
Changes
Vodr will notify enterprise customers with Data Processing Agreements of material sub-processor changes at least 30 days before they take effect. Enterprise customers who object to a new sub-processor may terminate their subscription without penalty within 30 days of the notice.
To request a Data Processing Agreement: privacy@vodr.ai
Version History
| Date | Change |
|---|---|
| 2026-03-27 | Initial publication. Three sub-processors named: Hetzner (Helsinki, EU), Stripe (US), Anthropic (US — DPA confirmed, SCCs in place). |