Subprocessors.

Customer-content infrastructure and AI

Convex, Inc.

Authentication, database, files and server-side processing. The production deployment is in Ireland (EU West). Convex is a US company; the deployment location does not establish that every subprocessor or support access stays in the EEA. Its DPA forms part of the service agreement. Coverage of Ente's processor/subprocessor role and transfer chain remains an open contractual clarification. DPA · Subprocessors.

Netlify, Inc.

Website and application delivery through a global network, including the private-file and session proxy. Processing can include customer file bytes as well as IP addresses, headers and request data. It is not limited to public static assets. The DPA forms part of the applicable service agreement. DPA.

OpenAI Ireland Ltd. and contracted affiliates

Hosted chat, agents, transcription, structuring, summaries and integrated web research can process audio, prompts, selected context, tool results and outputs. Production uses the global API route. Sharing controls and optional API logging were disabled in the reviewed existing OpenAI account. The production key-to-project/account binding was not established by that observation. Separately, the hosted Responses code uses store:false; neither observation establishes universal zero retention or EU-only processing. The services agreement incorporates the DPA; the actual account and transfer chain govern. DPA · Data controls.

Amazon Web Services

SES email, official and agent mailboxes, temporary S3/KMS raw-message storage and related processing use the documented Frankfurt infrastructure. Successfully routed raw messages are removed from the temporary store; its failure-recovery retention is at most 14 days. This is not the retention period for messages subsequently stored in Ente. A Kimi/Moonshot route through Bedrock in Stockholm remains configured for longer recordings, with a limited OpenAI fallback. An AWS access restriction does not prove the path was removed or can never receive data. AWS incorporates its DPA through service terms. Subprocessors · DPA.

Restricted analytics and inactive routes

PostHog EU Cloud (Frankfurt) is configured in the deployed product frontend. The restricted event path excludes user text, full URLs, stable Ente identifiers, persistence, autocapture and replay; network metadata is still processed. A completed TiVA Digital DPA is evidenced. PostHog DPA.

Google Cloud Pub/Sub is implemented but inactive: the required production topic was unset on 22 October 2026. Gmail continues through scheduled polling. Activation requires contractual and location review and prior notice under the DPA. Direct Anthropic and Linkup are not active recipients in the documented standard hosted route.

Customer-connected services

Customers may connect supported Google Gmail/Calendar, Microsoft/Outlook, IMAP/SMTP, CalDAV, Plaud or their own model endpoints. Their chosen features determine the exchanged data and credentials. A customer's provider does not automatically become an Ente-selected subprocessor. Roles, permissions and any additional Ente infrastructure must be assessed for the actual flow.

Transfers and changes

International processing requires an applicable adequacy decision or appropriate safeguards, with the actual roles and transfer circumstances assessed. Links to standard terms do not establish their applicability. The German annex provides provider identities, contacts and transfer details. The AVV requires prior written notice and an objection period normally of at least ten calendar days before new subprocessing; an updated website does not replace the accepted version.

Read the complete German provider and transfer annex.

Supplier website, billing and support processing

TiVA Digital acts as controller for its website, contract administration, billing and support. Netlify processes website requests including IP addresses, headers and requested URLs. Stripe processes payment, subscription, invoice and necessary contact data, acting as processor or independent controller depending on purpose. This does not give Stripe general access to CRM content. Support at support@ente.fast uses the existing AWS infrastructure in Frankfurt.

Stripe DPA · Netlify privacy

DataFast: website tracking removed, account connection unverified

The website release dated 22 October 2026 removes the DataFast script, website identifier and event calls. This does not revoke an external DataFast–Stripe account grant. The previously documented revenue connection may continue processing payment, subscription, invoice, refund, product and customer records, including contact details, until provider-side termination is confirmed. DataFast is operated by JustShipIt Pte. Ltd. in Singapore; the previous disclosure identifies infrastructure outside the EU including the US. Account-specific contractual and transfer evidence, revocation, retention and deletion of historical data remain unverified.

Previous providers and retained data

AgentMail is no longer offered as a contact route on this website. This does not confirm closure of the former external US mailbox or deletion of its messages, attachments or logs. DPA acceptance, transfer safeguards and remaining processing for that former vendor mailbox are not fully verified. Ente's own agent mailboxes use AWS and are separate. Direct Anthropic and Resend are not listed as active recipients in the current hosted processing route. Removing old disclosures or integrations does not delete historical vendor copies or business records subject to retention obligations.