Sub-Processor Register

In accordance with Art. 28 GDPR, we maintain a register of all sub-processors that process personal data as part of our services. This register is updated regularly. Last updated: March 2026.

Download as PDF

Service	Company	Location	Purpose	Data Processed	DPA Status
Vercel (Hosting)	Vercel Inc.	San Francisco, USA	Website and application hosting	IP address, user agent, access logs	Standard Contractual Clauses (SCCs)
Vercel Analytics	Vercel Inc.	San Francisco, USA	Cookieless website analytics	Page views, Core Web Vitals (anonymized)	SCCs (via Vercel DPA)
Vercel KV (Upstash)	Upstash Inc.	USA (EU data processing)	Rate limiting for abuse protection	Hashed IP addresses (TTL 24h)	SCCs (via Vercel DPA)
PostHog	PostHog Inc.	EU (eu.i.posthog.com)	Product analytics and usage statistics	Pseudonymized usage data, click behavior, IP address (EU servers)	DPA signed, EU hosting
Resend	Resend Inc.	San Francisco, USA	Transactional email delivery	Email address, name	SCCs
Google Workspace	Google Ireland Ltd.	Dublin, Ireland	Email, calendar, video conferencing	Name, email address, calendar events, video call data	SCCs + Google Data Processing Terms
Anthropic (Claude API)	Anthropic PBC	San Francisco, USA	AI-powered chat assistant on the website	Chat messages (user input), IP address (rate limiting)	SCCs + Zero Data Retention API
Supabase	Supabase Inc.	EU (Frankfurt)	Database and authentication	User account, profile data, study data	DPA signed, EU hosting (Frankfurt)
Voyage AI	Voyage AI Inc.	San Francisco, USA	Text embeddings for knowledge retrieval (RAG)	Document text chunks, chat queries	SCCs
IONOS	IONOS SE	Montabaur, Germany	Domain registration and DNS management	Domain WHOIS data (name, address of domain holder)	DPA (German company, GDPR-native)

Change Log

March 2026 — Initial publication

Contact

For questions about our sub-processors, contact us at datenschutz@busch-labs.at