# Sub-processors

Vendors that process data on behalf of Cortena.

**Last updated:** 8 Oct 2026

Cortena uses a limited set of approved sub-processors to deliver the Service. This page lists each sub-processor, their location, processing purpose, and data retention approach.

Optional rows (FinAPI, Yapily, Microsoft) apply only when enabled for that customer. FinAPI and Yapily: customer enables the integration in Cortena. Microsoft: customer enables it and Cortena enables it for the customer on request.

For questions or to request our full DPA/AVV, contact [compliance@cortena.ai](mailto:compliance@cortena.ai).

## 1. Purpose

To provide transparency about third parties that may process customer data on Cortena's behalf, in line with GDPR requirements.

## 2. Sub-processor list

| Sub-processor | Country | Purpose | Retention |
| --- | --- | --- | --- |
| **Hetzner Online GmbH** | Germany | Core infrastructure: hosting and storage of all platform data on dedicated servers in a private Kubernetes cluster | Duration of contract |
| **OpenAI Ireland Limited** | Ireland | LLM provider for finance workflow automation, including document extraction, classification, matching, analysis, and AI-assisted execution | Short-term processing only · data is not retained for model training |
| **Anthropic PBC** | United States | LLM provider used to generate and refine customer-specific accounting guidelines (chart of accounts logic, VAT treatment, matching guidelines) | Short-term processing only · data is not retained for model training |
| ~~**AC PM LLC (Postmark)**~~ | ~~United States~~ | ~~Inbound email routing: first reception and processing of financial documents submitted by email~~ · **Changed from 10 September 2026:** replaced by Cortena self-hosted inbound email via [receivehq.com](https://receivehq.com) (operated by Cortena) | ~~Up to 7 days~~ · Duration of contract |
| **Cortena B.V. (ReceiveHQ / receivehq.com)** | Germany | Inbound email routing: first reception and processing of financial documents submitted by email · Cortena-operated, self-hosted via receivehq.com | Duration of contract |
| **Google Cloud EMEA Limited (Google Workspace)** | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer | Duration of contract |
| **Microsoft Ireland Operations Limited** | Ireland | Storage and maintenance of AI instructions, business guidelines, and matching rules provided by the customer · **Optional:** only if the customer enables Microsoft and Cortena enables it for that customer on request | Duration of contract |
| **Yapily Ltd** | United Kingdom | PSD2-compliant open banking connectivity: bank transaction and payment operations · **Optional:** only if the customer enables Yapily / open banking in Cortena | Duration of contract |
| **finAPI GmbH** | Germany | PSD2 account information and payment initiation: bank connect, transaction sync, and SEPA payment authorization · **Optional:** only if the customer enables FinAPI in Cortena · **Offered from 24 August 2026** | Duration of contract |

## 3. International transfers

Core application data is stored and processed in **Germany** (Hetzner). Some sub-processors are located outside the EU/EEA:

- ~~**Postmark (US):** Limited to inbound email routing. Data retained for up to 7 days. Standard Contractual Clauses (SCCs) apply.~~ **From 10 September 2026**, inbound email is handled by **Cortena self-hosted via receivehq.com** (Germany), so this US transfer no longer applies for new inbound mail.
- **Anthropic (US):** Limited to generating and refining customer-specific accounting guidelines. Data is not retained beyond the immediate task. SCCs apply.
- **Yapily (UK):** Post-Brexit UK is treated as a third country. EU-UK adequacy decision applies where required.

All other sub-processors are located within the EU/EEA (Ireland or Germany), including inbound email via ReceiveHQ.

## 4. AI and LLM processing

Cortena uses OpenAI Ireland Limited and Anthropic PBC as LLM providers across finance workflow automation features.

Key commitments:

- LLM providers **do not store or log customer data** beyond the immediate processing request
- All transmissions are secured via **HTTPS/TLS**
- Cortena shares only the **minimum data necessary** for the requested task
- Customer data is **not used to train general-purpose AI models**

## 5. Sub-processor changes

Cortena will notify customers at least **14 days before** any new sub-processor is added or an existing one materially changes. Notification will be sent to the contact details provided in the applicable contract or DPA/AVV. Customers with an active DPA may object to new sub-processors within the notice period.

## 6. Contact

- Compliance / DPA: [compliance@cortena.ai](mailto:compliance@cortena.ai)
- DPO / Privacy (GDPR): [dpo@cortena.ai](mailto:dpo@cortena.ai)
- Support: [support@cortena.ai](mailto:support@cortena.ai)
- Company: Cortena B.V., Stadhouderskade 5 - 6, 1054 ES Amsterdam, Netherlands

## 7. List changelog

| Date | Change |
| --- | --- |
| **8 Oct 2026** | Added **finAPI GmbH** (Germany), optional when the customer enables FinAPI in Cortena · offered from 24 August 2026. Marked **Microsoft Ireland Operations Limited** optional (customer enables + Cortena enables on request). Set **ReceiveHQ** country to Germany. Clarified **Yapily** as optional when the customer enables open banking. |
| **10 Sep 2026** | Inbound email: **Postmark** replaced by Cortena self-hosted **ReceiveHQ** (receivehq.com). |