This page is the authoritative, current list of subprocessors referred to in our Data Processing Agreement (Section 3.4 and Annex 3) and Privacy Policy (Section 5). It lists the entities that process data on our behalf, the purpose of the processing, and where the processing takes place.
1. Sub-processors of Customer Content
The following sub-processors may process Customer Personal Data — personal data contained in content your organization uploads to Specky (documents, specifications, recordings, transcriptions, requirements, tasks) — as described in the DPA:
| Sub-processor | Purpose | Location of processing | Transfer safeguards |
|---|---|---|---|
| Hetzner Online GmbH | hosting of application, databases, file storage, embeddings, observability, backups | Germany (EU) | n/a — EU processing |
| Anthropic Ireland, Limited / Anthropic, PBC | LLM API — document analysis, requirement extraction, chat | EU contracting entity; processing may occur in the USA | DPF / SCC |
| OpenAI | LLM / embeddings API | USA | DPF / SCC |
| Paddle | Merchant of Record — payments, invoicing, tax | UK / EU / USA | DPF / SCC (as applicable) |
| cal.pl | transactional (system) email delivery and marketing-website hosting | Poland (EU) | n/a — EU processing |
Primary data storage (databases, uploaded files, embeddings, and AI observability data) is located exclusively in the European Union (Germany). AI providers receive document content transiently for processing, as described in Section 4 of the Privacy Policy.
2. Analytics and account-data providers
For account data and usage analytics — where we act as an independent controller under the Privacy Policy rather than as your processor — we additionally use:
| Provider | Purpose | Location of processing |
|---|---|---|
| Google Ireland Limited / Google LLC (Google Analytics) | marketing-website analytics (consent-based) | EU / USA |
| Mixpanel, Inc. | in-product analytics (consent-based) | EU data residency; Mixpanel, Inc. is US-based, so access from the USA cannot be excluded |
3. Change notifications
We will notify customers of intended additions or replacements of sub-processors at least 30 days in advance — via this page and in-app or email notice — as described in Section 3.4 of the DPA. Customers may object on reasonable data-protection grounds within 14 days of notice.
4. Change log
| Date | Change |
|---|---|
| 4 August 2026 | Initial publication of this page (list identical to DPA v1.0, Annex 3). |
Questions about this list: support@specky.app.