Subprocessors
Last updated: 19 July 2026
Traken engages the following subprocessors to provide the Service. For each we list the purpose, location of processing, and the transfer mechanism relied on for personal data originating in the EEA, the UK, or Switzerland. Traken's default infrastructure is EU-based. Because of the Zero-Data architecture, no AI prompt or response content is shared with any subprocessor. We will update this page at least 30 days before a new subprocessor handling personal data begins processing; business customers may subscribe to change notifications by emailing legal@traken.ai with the subject "Subprocessor notifications".
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Compute and hosting (application servers) | Germany (EU) | Within EEA — no transfer mechanism required |
| Cloudflare, Inc. | DNS, CDN, Pages hosting, cookieless Web Analytics, network security | United States / global edge (EU data-localisation options) | EU-U.S. Data Privacy Framework (Active, participant 5666); EU SCCs as fallback in Cloudflare's DPA |
| Supabase | PostgreSQL database and authentication | European Union (EU region) | Within EEA — no transfer mechanism required |
| Mistral AI | Default LLM inference for Narrative Report generation (La Plateforme) | European Union (France) | Within EEA — no transfer mechanism required |
| Anthropic, PBC | Optional premium LLM inference (Claude API), zero-data-retention configuration | United States | EU Standard Contractual Clauses (Decision 2021/914) + supplementary measures; not DPF-certified |
| n8n Cloud (n8n GmbH) | Workflow automation / orchestration | European Union (data stored in the EU) | Within EEA — no transfer mechanism required |
| Paddle (Paddle.com Market Ltd / Paddle Payments) | Payments, billing, invoicing, tax, refunds (Merchant of Record) | United Kingdom / United States | UK adequacy decision (EU→UK); EU SCCs / DPF for any onward US transfers |