Last updated: 11 June 2026
What this page is. A complete list of the third-party services Aurora AI Solutions Studio UG ("Aurora") uses to deliver Aurora CapacityOS (the Campaign Desk, Retention Desk, and Flight Deck) and the KI-Beratung consulting line. Customers, prospects, and Datenschutzaufsichtsbehörden can consult this page at any time to see the full sub-processor chain that touches their data.
This list is the canonical version. The same content appears in the relevant sections of our Data Processing Agreement (DPA §4) and our Privacy Policy (§4). If you spot any inconsistency, the most recently dated source wins; please email privacy@helloaurora.ai so we can reconcile.
These sub-processors are used across Aurora CapacityOS (all desks) and the KI-Beratung consulting line.
| Sub-processor | Purpose | Location | Data category | Legal terms |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, row-level security, encrypted vault for OAuth, delegated-access, and legacy BYOK credentials | EU (Frankfurt, AWS eu-central-1) | Account profile, app data, hashed credentials, generated content, audit metadata | DPA · Privacy |
| Vercel Inc. | Application hosting, edge functions, CDN | EU (Frankfurt, fra1) compute · global anycast CDN | HTTP requests, page rendering data, edge logs | DPA · Privacy |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payment processing, billing, invoicing, tax calculation (once billing opens) | US (SCCs) · EU acquirer (Ireland, Frankfurt) | Billing email, name, payment method last-4, billing address, VAT-ID, invoice line items | DPA · Privacy |
| Resend Inc. (sub-sub-processor: AWS EMEA SARL / SES eu-west-1) | Transactional email delivery: account notifications, brief sends, white-label client reports, DPA confirmations | EU (Ireland) | Recipient email, sender email, message subject and body, send metadata | DPA · Privacy |
| Inngest, Inc. | Background job orchestration: signal fan-out, scheduled report builds, agent skill dispatch, retry queues | US (SCCs) | Job payloads (may include client names, signal references, run identifiers) | DPA · Privacy |
| Sentry (Functional Software, Inc.) | Error tracking and performance monitoring | US (SCCs) | Stack traces, request URLs, anonymised user identifier, browser/OS metadata | DPA · Privacy |
| Upstash, Inc. | Distributed rate limiting (Redis) for abuse protection and API throttling | EU (Frankfurt) | Hashed identifiers (IP + user ID + route), counters, TTL timestamps | DPA · Privacy |
These sub-processors are used for AI inference in Aurora CapacityOS. Anthropic is Aurora's primary model provider; OpenAI is used as the fallback LLM provider and for embeddings and transcription. Workspaces carried over from Aurora's earlier product line may instead run model calls under their own provider API key — see §3 below.
| Sub-processor | Purpose | Location | Data category | Legal terms |
|---|---|---|---|---|
| Anthropic PBC (Claude API) | Primary LLM provider: agent skill execution, health scoring, signal classification, content drafting, voice-profile generation, learning agent | US (SCCs) | Prompts (may include client names, message snippets, voice samples); model outputs | Terms · DPA · Trust |
| OpenAI L.L.C. | LLM processing (fallback provider); text embeddings (text-embedding-3-small) for semantic signal search; Whisper transcription for Zoom cloud recordings | US (SCCs) | Prompts and model outputs (fallback runs); text snippets for embedding; audio recordings for transcription | DPA · Enterprise privacy |
| Deepgram, Inc. | Audio and video transcription (Campaign Desk, primary provider) | US (SCCs) | Audio/video files uploaded by customers for transcription | DPA · Privacy |
| AssemblyAI, Inc. | Audio transcription (Campaign Desk, legacy fallback only) | US (SCCs) | Audio files uploaded by customers for transcription | DPA · Privacy |
Some workspaces carried over from Aurora's earlier product line run AI processing under the customer's own LLM API key (Bring-Your-Own-Key). Where such a configuration is active, the chosen provider becomes an additional sub-processor for the duration of agent skill execution. The customer's choice of provider determines which sub-processor applies. Aurora stores the BYOK credential pgsodium-encrypted on the profiles.operator_credential column; the plaintext key is decrypted just-in-time per invocation and discarded. Raw prompts and raw completions are not retained — only structured skill metadata (skill id, version, timestamps, status, cost, output reference) is logged for billing transparency and audit.
| BYOK provider (customer-selected) | Purpose | Location | Data category | Legal terms |
|---|---|---|---|---|
| Anthropic PBC (Claude Opus / Sonnet / Haiku) | Agent skill LLM execution under the customer's own Anthropic API key (legacy BYOK configurations only) | US (SCCs) | Prompts and completions assembled at skill-run time | DPA |
| OpenAI L.L.C. (GPT-5 family) | Agent skill LLM execution under the customer's own OpenAI API key (legacy BYOK configurations only) | US (SCCs) | Prompts and completions assembled at skill-run time | DPA |
| Google LLC (Gemini 2.x) | Agent skill LLM execution under the customer's own Google API key (legacy BYOK configurations only) | US (DPF / SCCs) | Prompts and completions assembled at skill-run time | DPA |
The Aurora marketing site uses a deliberately small set of sub-processors. Self-hosted fonts mean no Google Fonts request; first-party analytics mean no third-party trackers.
| Sub-processor | Purpose | Location | Data category | Legal terms |
|---|---|---|---|---|
| Vercel Inc. | Static site hosting and CDN for helloaurora.ai | EU (Frankfurt) · global anycast CDN | HTTP request logs (anonymised IP) | Privacy |
| Calendly LLC (KI-Beratung consulting only) | Discovery-call scheduling for the KI-Beratung (German consulting) line | US (SCCs) | Name, email, timezone, scheduled meeting details | DPA · Privacy |
The following services often appear when customers compare Aurora to other SaaS, but they are not Aurora sub-processors under GDPR Art. 28:
Notice of changes to this list. When Aurora adds a new sub-processor to any of the tables above, we update the "Last updated" date at the top of this page and the corresponding section of our DPA. Where contractually required (for example under enterprise DPAs or our standard customer DPA at §4 last paragraph), Aurora notifies customers at least 30 days before the new sub-processor begins processing customer personal data, so the customer has an opportunity to object.
If you would like to receive these notifications by email, write to privacy@helloaurora.ai with the subject line "Sub-processor change notifications — opt in" and we will add you to the notice list.
Questions, complaints, or objections about any sub-processor on this list: privacy@helloaurora.ai.
Aurora AI Solutions Studio UG, Stuttgart, Germany (Amtsgericht Stuttgart HRB 805284) is the data controller for personal data processed in connection with Aurora's services, and the data processor for customer personal data processed under our Data Processing Agreement. See our Impressum for full company details and our Privacy Policy for the rights you have over your data (GDPR Art. 12–22) and how to exercise them.
Change note (11 June 2026): Updated to reflect the consolidation of our offerings into Aurora CapacityOS.