Subprocessor List
Last updated: July 7, 2026
This annex lists third-party subprocessors that process personal data on behalf of Boske when you use our cloud-hosted Services. Our Article 28 data processing agreement, which covers this annex, is available on request.
Current subprocessors
| Subprocessor | Purpose | Region | Retention |
|---|---|---|---|
| Mistral AI | Cloud LLM inference, OCR, and speech-to-text APIs | EU (France) | Per processor contract — see DPA Annex III |
| Hetzner Online GmbH | EU cloud hosting and object storage | EU (Germany) | Per processor contract — see DPA Annex III |
| Stripe, Inc. | Payment processing and subscription billing | EU/US (per Stripe DPA) | Per processor contract — see DPA Annex III |
| Google LLC | OAuth sign-in (when enabled) | EU/US | Per processor contract — see DPA Annex III |
| Microsoft Corporation | OAuth sign-in (when enabled) | EU/US | Per processor contract — see DPA Annex III |
| Web search and page reading | Web search and page reading — enabled. Query text is sent to Brave Search (Brave Software, Inc., United States) to obtain results; Brave keeps queries for at most 90 days for billing and abuse prevention and does not link them to you. Page fetching and result ranking run on our own servers, and page content is fetched from the third-party site you asked for. A data processing agreement is in place with Brave Software, Inc. | EU (Germany), onward to public search engines | Our instance retains no query text; upstream engines apply their own policies |
OAuth providers
Google and Microsoft are subprocessors only when you choose to sign in with those providers.
Updates
We will update this list when we add or replace subprocessors. Material changes will be reflected on this page with an updated date.