Sub-processors
This list belongs to our Data processing agreement (Annex 3). It names the companies that process personal data from your customer data on our behalf. That is mainly data about the visitors of your websites and apps, and the content of your chats with Mira.
Sub-processors
| Sub-processor | Service | Place of processing | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers for the app, the API, the collector, the worker and the database (cloud server in Nuremberg). Our tool server (error monitoring, monitoring, Git server and deploy control) in Falkenstein. Hetzner is certified under ISO/IEC 27001:2022 for its hosting services and data centres, including Nuremberg and Falkenstein. We have concluded a data processing agreement under Art. 28 GDPR with Hetzner. | Nuremberg and Falkenstein, Germany | Not needed (European Union) |
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Receives all requests to app.mirafive.io, api.mirafive.io and collect.mirafive.io. It ends the encrypted connection close to the visitor, passes the requests to our server through a tunnel, applies security rules and adds the region and city to a request. It sees visitor IP addresses, session cookies, chat content and API keys. It also delivers the website mirafive.io and the public script files from cdn.mirafive.io. Its Data Processing Addendum is part of our agreement. Cloudflare holds ISO/IEC 27001 and SOC 2 Type II certifications. | Worldwide edge network, USA | EU-U.S. Data Privacy Framework (Cloudflare, Inc. is certified); the standard contractual clauses of the Cloudflare Data Processing Addendum as fallback |
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Encrypted database backups. Storage for export files, logos and icons. AI models (Amazon Bedrock): Mira’s answers are generated by Claude models that AWS runs for us in Amazon Bedrock (section 3(8) of the DPA). The backups are encrypted on our server before they reach AWS, and AWS does not hold the key. AWS holds ISO/IEC 27001 and SOC 2 certifications. The AWS GDPR Data Processing Addendum is part of the AWS Service Terms. | Backups and files: Frankfurt, Germany (eu-central-1). AI: AWS regions in the European Union (Frankfurt; requests can be routed between AWS regions in the EU). | Not needed for storage and AI in the European Union. Access from the USA for support and operations cannot be ruled out: EU-U.S. Data Privacy Framework (Amazon.com, Inc. and its U.S. subsidiaries) and the standard contractual clauses of the AWS Data Processing Addendum |
| Mailjet SAS (a Sinch company), 43 rue de Dunkerque, 75010 Paris, France | Sending the emails from MIRA FIVE. Digest and alert mails can hold figures and names of referrers and pages from your data. The Mailjet data processing agreement, with standard contractual clauses, is part of the agreement. | European Union (data centres in Germany and Belgium) | Not needed (European Union). No transfer to a third country is planned. |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Email mailboxes (Google Workspace), only where you send us personal data in support requests | EU; transfer to the USA possible | Data Privacy Framework, standard contractual clauses |
The application, its database and the collection endpoints run on one server of the hosting provider. The server accepts traffic only from the Cloudflare tunnel. The programs of MIRA FIVE do not store visitor IP addresses and do not write them to a log. Cloudflare receives them, because it receives all requests.
The AI model receives data only when a member of your organisation asks Mira a question. The model runs in Amazon Bedrock in the European Union. We configure Amazon Bedrock so that AWS writes no prompt and no answer to durable storage (zero data retention). Anthropic, the maker of the models, has no access to the prompts and answers and does not receive them. The data is not used to train any model. Processing for the AI stays in the European Union. The data that the AI requests can hold is described in section 3(8) of the Data processing agreement.
For Google Workspace, a transfer to the USA relies on Google LLC’s certification under the EU-U.S. Data Privacy Framework and on the European Commission’s standard contractual clauses. Only send us personal data about your visitors when a support request really needs it.
Not sub-processors
We use these service providers, but they do not process customer data on our behalf:
| Service provider | Task | Why it is not a sub-processor |
|---|---|---|
| Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland, and Sold through Link, LLC | Payment for your plan. We sell Pro through Stripe Managed Payments. Sold through Link, LLC, an affiliate of Stripe, is the merchant of record: it handles the checkout, charges you, calculates, collects and pays VAT and other sales taxes, and issues receipts and invoices in its own name. | Stripe and Sold through Link, LLC process payment data about your organisation, which is account data, for their own purposes as independent controllers (privacy policy: https://stripe.com/privacy). For transfers to the USA, Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, and the Stripe data processing agreement contains standard contractual clauses. |
Cloudflare also delivers the pages of the website mirafive.io and the script files from cdn.mirafive.io. These requests hold no customer data.
Platforms you connect yourself, such as Google Ads, Google Search Console, Meta Ads, Microsoft Advertising, Bing Webmaster Tools and your own Stripe account, are not sub-processors either. The same applies to API clients and AI assistants you connect through the REST API or the Model Context Protocol (MCP). You choose these recipients, and data only flows to them on your instruction.
Our own tools are not sub-processors. We run error monitoring (Sentry) and monitoring on our own server in Falkenstein, Germany. Error reports contain no user data, cookies, headers, request bodies or query strings, and we keep them 14 days.
Changes to this list
Before we add or replace a sub-processor, we inform the owners of all organisations by email at least 30 days in advance and update this page. You can object to the change on reasonable data protection grounds within 14 days. Section 5 of the Data processing agreement sets out the details.
Questions about this list: hello@mirafive.io