Legal
Sub-processors
Last updated: April 16, 2026
Qonera uses the following sub-processors to provide the Services. Each processes limited customer personal data on our behalf under our Data Processing Agreement and appropriate safeguards, including EU Standard Contractual Clauses (SCCs) where required.
Infrastructure
Vercel Inc.
Application hosting, edge network, and file storage (Blob).
Blob storage in Frankfurt (eu-central-1). Edge network is global with EU function regions.
Neon Inc.
Managed PostgreSQL database.
Hosted in Frankfurt (eu-central-1).
Upstash
Redis caching, sessions, and rate limiting.
Frankfurt (eu-central-1).
AI and processing
OpenAI, L.L.C.
GPT large language models for drafting, synthesis, review, and automated risk classification.
Contractually does not train on customer data (Enterprise/API data policy). Transfers protected by EU Standard Contractual Clauses (SCCs).
Anthropic PBC
Claude large language models for analysis and generation.
Contractually does not train on customer data. Transfers protected by EU Standard Contractual Clauses (SCCs).
Google Cloud (Vertex AI)
Gemini large language models for analysis and generation.
Hosted in Frankfurt (eu-central-1) via Vertex AI. Google Cloud data processing terms prohibit training on customer data. EU region, no international transfer required.
Tavily
Web search tool used by the assistant when needed.
Transfers protected by SCCs.
Operations
Stripe Inc.
Payment processing and subscription billing.
Card data is tokenised by Stripe and never stored on Qonera servers (Qonera is out of PCI DSS scope for card-holder data). Transfers protected by SCCs.
Resend
Transactional email (sign-up, password reset, receipts).
Sentry
Error and performance monitoring.
Hosted on de.sentry.io.
Google LLC
Google Sign-In (OAuth) for account authentication.
Transfers protected by SCCs.
International data transfers
For sub-processors outside the European Economic Area, Qonera relies on the European Commission's Standard Contractual Clauses (SCCs) and appropriate supplementary technical and organisational measures. Enterprise customers may request the executed SCCs as an addendum to our Data Processing Agreement.
Updates to this list
Qonera will notify customers at least 14 days before onboarding any new sub-processor, giving enterprise customers the opportunity to object in writing. Material changes to this page will update the "Last updated" date above.
Contact
For questions about our sub-processors, to request the executed SCCs, or to raise an objection to a new sub-processor, contact:
Qyvo P.S.A.NIP (VAT): 5851509019
KRS: 0001195545
Poland
security@qonera.ai