Cortena uses a limited set of approved sub-processors to deliver the Service. This page lists each sub-processor, their location, processing purpose, and data retention approach.
For questions or to request our full DPA/AVV, contact compliance@cortena.ai.
1. Purpose
To provide transparency about third parties that may process customer data on Cortena's behalf, in line with GDPR requirements.
2. Sub-processor list
| Sub-processor | Country | Purpose | Retention |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Core infrastructure: hosting and storage of all platform data on dedicated servers in a private Kubernetes cluster | Duration of contract |
| OpenAI Ireland Limited | Ireland | LLM provider for finance workflow automation, including document extraction, classification, matching, analysis, and AI-assisted execution | Short-term processing only · data is not retained for model training |
| Anthropic PBC | United States | LLM provider used to generate and refine customer-specific accounting guidelines (chart of accounts logic, VAT treatment, matching guidelines) | Short-term processing only · data is not retained for model training |
| AC PM LLC (Postmark) | United States | Inbound email routing: first reception and processing of financial documents submitted by email | Up to 7 days |
| Google Cloud EMEA Limited (Google Workspace) | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer | Duration of contract |
| Microsoft Ireland Operations Limited | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer | Duration of contract |
| Yapily Ltd | United Kingdom | PSD2-compliant open banking connectivity: bank transaction and payment operations (if enabled) | Duration of contract |
3. International transfers
Core application data is stored and processed in Germany (Hetzner). Some sub-processors are located outside the EU/EEA:
- Postmark (US): Limited to inbound email routing. Data retained for up to 7 days. Standard Contractual Clauses (SCCs) apply.
- Anthropic (US): Limited to generating and refining customer-specific accounting guidelines. Data is not retained beyond the immediate task. SCCs apply.
- Yapily (UK): Post-Brexit UK is treated as a third country. EU-UK adequacy decision applies where required.
All other sub-processors are located within the EU/EEA (Ireland or Germany).
4. AI and LLM processing
Cortena uses OpenAI Ireland Limited and Anthropic PBC as LLM providers across finance workflow automation features.
Key commitments:
- LLM providers do not store or log customer data beyond the immediate processing request
- All transmissions are secured via HTTPS/TLS
- Cortena shares only the minimum data necessary for the requested task
- Customer data is not used to train general-purpose AI models
5. Sub-processor changes
Cortena will notify customers at least 14 days before any new sub-processor is added or an existing one materially changes. Notification will be sent to the contact details provided in the applicable contract or DPA/AVV. Customers with an active DPA may object to new sub-processors within the notice period.
6. Contact
- Compliance / DPA: compliance@cortena.ai
- DPO / Privacy (GDPR): dpo@cortena.ai
- Support: support@cortena.ai
- Company: Cortena B.V., Stadhouderskade 5 - 6, 1054 ES Amsterdam, Netherlands