Sub-processors
Who else touches your data.
A sub-processor is a company that processes customer data on our behalf so that the service can run at all. This is the whole list. It is short on purpose, and it is the list our data processing agreement refers to.
| Name | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting. The servers your documents, passages, facts and database actually sit on. | Germany (EU) |
| Cloudflare | The published route to the service. Terminates the encrypted connection and sees request metadata in transit; it does not store your documents. | Global — the Cloudflare location nearest each visitor |
| Anthropic — Claude API | Reading documents, extracting facts, writing answers. Receives document text and the questions asked of it, under terms that exclude training. | United States |
| OpenRouter, routing to OpenAI (text-embedding-3-small, 768 dimensions) | Turning document text into the numeric form recall searches by. Receives passage text, never a question you ask; OpenRouter does not train on it, and by default neither does OpenAI, for API traffic. | United States |
| Resend | Transactional mail — email verification, invites, password resets, and payment-failure or plan-lapse notices. Receives the recipient address and the letter's contents. | Ireland (EU) |
| Stripe | Payments. Receives your billing details directly; we never hold your card. | Ireland (EU) and the United States |
Current as of 6 October 2026
On private cloud and self-host
Run Nemosyne on your own premises and this list is not yours: the hosting is yours, the object store is yours, and the model runs under your own keys against whichever provider you point it at. The only outbound reach is the one your deployment declares, and it can be set to nothing at all. A private cloud we run for you uses the same AI model provider as our hosted service, named above.
Changes to this list
We will tell customers before a company is added to this list, and we will say what it does and where it is. If you object to a new sub-processor, the data processing agreement says what happens next. The same five names, with the same purposes, are also in our privacy policy.