Last updated: 8 Oct 2026
Cortena uses a limited set of approved sub-processors to deliver the Service. This page lists each sub-processor, their location, processing purpose, and data retention approach.
Optional rows (FinAPI, Yapily, Microsoft) apply only when enabled for that customer. FinAPI and Yapily: customer enables the integration in Cortena. Microsoft: customer enables it and Cortena enables it for the customer on request.
For questions or to request our full DPA/AVV, contact compliance@cortena.ai.
1. Purpose
To provide transparency about third parties that may process customer data on Cortena's behalf, in line with GDPR requirements.
2. Sub-processor list
| Sub-processor | Country | Purpose | Retention |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Core infrastructure: hosting and storage of all platform data on dedicated servers in a private Kubernetes cluster | Duration of contract |
| OpenAI Ireland Limited | Ireland | LLM provider for finance workflow automation, including document extraction, classification, matching, analysis, and AI-assisted execution | Short-term processing only · data is not retained for model training |
| Anthropic PBC | United States | LLM provider used to generate and refine customer-specific accounting guidelines (chart of accounts logic, VAT treatment, matching guidelines) | Short-term processing only · data is not retained for model training |
| Cortena B.V. (ReceiveHQ / receivehq.com) | Germany | Inbound email routing: first reception and processing of financial documents submitted by email · Cortena-operated, self-hosted via receivehq.com | Duration of contract |
| Google Cloud EMEA Limited (Google Workspace) | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer | Duration of contract |
| Microsoft Ireland Operations Limited | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer · Optional: only if the customer enables Microsoft and Cortena enables it for that customer on request | Duration of contract |
| Yapily Ltd | United Kingdom | PSD2-compliant open banking connectivity: bank transaction and payment operations · Optional: only if the customer enables Yapily / open banking in Cortena | Duration of contract |
| finAPI GmbH | Germany | PSD2 account information and payment initiation: bank connect, transaction sync, and SEPA payment authorization · Optional: only if the customer enables FinAPI in Cortena · Offered from 24 August 2026 | Duration of contract |
3. International transfers
Core application data is stored and processed in Germany (Hetzner). Some sub-processors are located outside the EU/EEA:
Postmark (US): Limited to inbound email routing. Data retained for up to 7 days. Standard Contractual Clauses (SCCs) apply.From 10 September 2026, inbound email is handled by Cortena self-hosted via receivehq.com (Germany), so this US transfer no longer applies for new inbound mail.- Anthropic (US): Limited to generating and refining customer-specific accounting guidelines. Data is not retained beyond the immediate task. SCCs apply.
- Yapily (UK): Post-Brexit UK is treated as a third country. EU-UK adequacy decision applies where required.
All other sub-processors are located within the EU/EEA (Ireland or Germany), including inbound email via ReceiveHQ.
4. AI and LLM processing
Cortena uses OpenAI Ireland Limited and Anthropic PBC as LLM providers across finance workflow automation features.
Key commitments:
- LLM providers do not store or log customer data beyond the immediate processing request
- All transmissions are secured via HTTPS/TLS
- Cortena shares only the minimum data necessary for the requested task
- Customer data is not used to train general-purpose AI models
5. Sub-processor changes
Cortena will notify customers at least 14 days before any new sub-processor is added or an existing one materially changes. Notification will be sent to the contact details provided in the applicable contract or DPA/AVV. Customers with an active DPA may object to new sub-processors within the notice period.
6. Contact
- Compliance / DPA: compliance@cortena.ai
- DPO / Privacy (GDPR): dpo@cortena.ai
- Support: support@cortena.ai
- Company: Cortena B.V., Stadhouderskade 5 - 6, 1054 ES Amsterdam, Netherlands
7. List changelog
| Date | Change |
|---|---|
| 8 Oct 2026 | Added finAPI GmbH (Germany), optional when the customer enables FinAPI in Cortena · offered from 24 August 2026. Marked Microsoft Ireland Operations Limited optional (customer enables + Cortena enables on request). Set ReceiveHQ country to Germany. Clarified Yapily as optional when the customer enables open banking. |
| 10 Sep 2026 | Inbound email: Postmark replaced by Cortena self-hosted ReceiveHQ (receivehq.com). |