Uprelic
Subprocessors & AI Providers
When your credits run out, AI processing now continues on the free tier’s model instead of pausing. Terms § 2.4, the Business Terms and the Service Description are updated accordingly.
August 28, 2026
This page lists the third-party providers Uprelic GmbH engages to deliver the Services ("subprocessors"), the AI model providers available on the platform, and where processing takes place. It is referenced by our Terms of Service, Business Terms and Data Processing Agreement. We update this page when the list changes; business customers can object to changes as described in the DPA. Earlier versions remain retrievable via the version selection on this page.
Where your content lives
All customer content at rest — your account, files, chats, documents, vector indexes and system logs — is stored on servers we rent in Germany/EU (Hetzner) and operate ourselves.
The systems a company of our size would usually buy as a hosted service — our database and authentication, our vector search, our error monitoring, our AI tracing, our browser rendering and our code sandboxes — we run ourselves on those servers, so there is no software vendor behind them to name here. The servers themselves are a different matter: Hetzner provides them, Hetzner is a subprocessor, and it is listed below. We run no product analytics at all.
Content leaves our infrastructure only when a request requires it: to the AI model provider serving your request, to the search provider for web search, and to the platform services listed below.
Infrastructure and platform services
| Provider | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner (Germany) | Hosting of all Uprelic servers and self-hosted services | All service data at rest | Germany / EU | — (EU processing) |
| Cloudflare, Inc. (USA) | DNS, CDN and traffic protection in front of our domains | IP addresses, connection metadata | Global edge locations | EU–US Data Privacy Framework; EU SCCs |
| Amazon Web Services (SES) | Transactional email (invitations, notifications) | Email address, notification content | EU (eu-central-1, Frankfurt) | AWS DPA; EU SCCs where applicable |
| Stripe | Payment processing and tax calculation | Billing identity, payment method (tokenised), transaction history | EU / USA | Stripe DPA; EU SCCs; DPF. Stripe acts as an independent controller for fraud prevention and compliance |
| Apple / Google | Mobile app distribution | The app itself, and the store's own record of your installation | USA | EU SCCs / DPF (standard platform terms) |
| Composio, Inc. (USA) | Integration broker for the extended tool catalogue | OAuth tokens for tools you connect via the catalogue, tool-call payloads | USA | DPA with EU SCCs |
AI model providers
Your prompts, relevant context and files are sent to the model provider serving your request. Which provider is used follows from the model you (or your workspace) select, and from the task: document generation, transcription and image analysis run on models chosen for those steps. The table names the providers rather than the individual models, because the model line-up changes often; the provider is what determines where your content goes and under which contract. All providers below are bound not to use your content to train their models, on the basis stated.
| Provider | Location | No-training basis | Transfer mechanism | Status |
|---|---|---|---|---|
| Fireworks AI, Inc. (USA) | USA | Contractual — no training without explicit opt-in; no prompt logging for open models | DPA + EU SCCs | Active |
| OpenAI | USA (EU residency available) | API content not used for training by default | DPA + EU SCCs | Active |
| Anthropic | USA | Commercial API content not used for training by default | DPA + EU SCCs | Active |
| Groq (Groq UK Limited for EEA customers) | Compute incl. EU; storage USA | Contractual — Inputs/Outputs may not be used for training or fine-tuning | UK adequacy + EU SCCs | Active |
| Cerebras Systems (USA) | USA | No retention of inference inputs/outputs | DPA + EU SCCs (clickwrap) | Active |
Web search
When the assistant needs current information it sends a search query — and nothing else — to one of the two providers below. Both are used in normal operation; which one handles a given query follows from the query itself. Neither receives your name, your account, or any identifier that would let it connect the query to you. The result pages are then fetched by our own browser infrastructure rather than by the search provider.
| Provider | Data reaching the provider | Location | Retention by the provider | Transfer mechanism |
|---|---|---|---|---|
| European Search Perspective, SAS ("Staan"), France | The search query | France / EU; the provider may route some queries to a US sub-processor of its own | 25 months | — (EU processing); Art. 28 DPA |
| Brave Software, Inc. (Brave Search API), USA | The search query | USA | 90 days | EU standard contractual clauses, incorporated by Annex V of the provider's Data Processing Addendum of 21 April 2026 |
Questions and notifications
Questions about this list: [email protected]. Business customers receive subprocessor-change notifications as described in the Data Processing Agreement; a self-service notification subscription is planned.