Aurora sub-processors

Last updated: 21 July 2026

What this page is. The complete, canonical list of third-party services Aurora AI Solutions Studio UG ("Aurora") uses to deliver Aurora CapacityOS — the managed service in which AI-agent workflows process incoming emails and documents and prepare replies under human approval. Customers, prospects, and supervisory authorities can consult this page at any time.

This list is the single source of truth. Our Data Processing Agreement (§6) and Privacy Policy (§6) reference it rather than duplicating it. If you spot an inconsistency anywhere, this page (with the most recent date) governs — and please tell us at privacy@helloaurora.ai.

How to read the table

Sub-processor: the legal entity that processes personal data on Aurora's behalf.
Purpose: what Aurora uses the service for.
Location: where the data is processed. EU = stays in the EU/EEA; US = transfer to the United States under the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs); global = CDN edge routing.
Data category: what kind of personal data the service can receive.
Legal terms: the sub-processor's own DPA or privacy documentation.

1. Sub-processors for Aurora CapacityOS

Sub-processor	Purpose	Location	Data category	Legal terms
Hetzner Online GmbH	Hosting of the workflow engine — the server that reads incoming workflow mail, runs the checks, and prepares drafts	EU (Germany)	Workflow emails and attachments, extracted case data, drafts, run logs	Privacy · DPA
Supabase, Inc.	Databases: run records, approval items, learned rules, document retrieval index (incl. vector search); reviewer authentication for the cockpit	EU (Frankfurt, AWS eu-central-1)	Run and approval records, indexed document content, reviewer account data	DPA · Privacy
Google Ireland Ltd. (Google Workspace)	Only where the engagement uses Aurora-provided workflow mailboxes (typical for demos and pilots): receiving workflow email on helloaurora.ai addresses and sending approved replies. Engagements that run on the customer's own mail system (e.g. Microsoft 365 — see §3) or involve no email do not use this sub-processor.	EU/EEA, possible transfers to Google LLC (US, DPF)	Email content and metadata of workflow correspondence routed through Aurora-provided addresses	DPA · Privacy
Vercel Inc.	Hosting of the approval surface (cockpit) and the helloaurora.ai website	EU (Frankfurt, fra1) compute · global anycast CDN · US entity (DPF/SCCs)	HTTP requests, page rendering data, short-lived edge logs	DPA · Privacy
Anthropic PBC (Claude API)	Primary model provider: reading and extracting case facts, running the named checks, drafting replies within workflow runs	US (DPF/SCCs)	Case content passed per step (message text, document content, relevant reference excerpts); model outputs. No training on API data per commercial terms.	Terms · DPA · Trust
OpenAI, L.L.C.	Text embeddings for document retrieval (semantic search over the customer's reference material); configured fallback model provider	US (DPF/SCCs)	Text snippets for embedding; prompts and outputs on fallback runs. No training on API data per API terms.	DPA · Enterprise privacy
Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.)	Payment processing for subscription billing	EU acquirer (Ireland) · US (DPF/SCCs)	Billing contact, payment-method reference (last 4), billing address, VAT ID, invoice line items — never workflow content	DPA · Privacy

2. Website-only services (helloaurora.ai)

These services touch website visitors only — never customer workflow data.

Service	Purpose	Location	Data category	Legal terms
BunnyWay d.o.o. (Bunny Fonts)	Font delivery for the start page (EU, zero-log font CDN)	EU (Slovenia)	Technical request data (no cookies, no stored identifiers per provider)	Privacy
Calendly LLC	Demo-call scheduling (external booking page, opened only when you click "Book a demo")	US (DPF/SCCs)	Name, email, timezone, chosen slot — entered by you on Calendly's page	DPA · Privacy
Google Ireland Ltd. / Google LLC (YouTube)	Demo-video playback — loads only after you press play (youtube-nocookie.com)	US (DPF)	IP address and device data, only after your click	Privacy

3. What is not a sub-processor

The customer's own systems and their clients' systems — mailboxes, folders, or platforms a customer (or its end-client) grants the workflows access to (e.g. the customer's own Microsoft 365 or Google account, a document store, or a line-of-business system) remain the granting party's own controller relationship with that platform. Aurora processes only the data reachable under the grant, and outward effects pass the human approval gate. See DPA §6.
Banking institutions — Qonto (Olinda SAS, France/EU) for business banking and invoicing, and Wise (EU) for non-EUR accounts, act as independent controllers under banking regulation.
Uptime monitoring — our external watchdog receives only heartbeat pings from the engine; no personal data.
Fonts on legal pages, analytics — legal pages use self-hosted fonts; Aurora uses no third-party web analytics anywhere on helloaurora.ai.

Notice of changes to this list. When Aurora adds a sub-processor, we update this page and notify customers at least 30 days before the new sub-processor begins processing customer personal data, so customers can object (see DPA §6). To receive change notifications by email, write to privacy@helloaurora.ai with the subject "Sub-processor change notifications — opt in".

Questions or objections about any entry: privacy@helloaurora.ai.

4. Aurora's roles

Aurora AI Solutions Studio UG (haftungsbeschränkt), Stuttgart, Germany (Amtsgericht Stuttgart HRB 805284) is the processor for customer workflow data under the Data Processing Agreement, and the controller for its own website, contracting, and billing data as described in the Privacy Policy.