List of sub-processors
This is a working English translation. The binding version is the German Unterauftragsverarbeiter list.
This overview supplements the privacy policy and lists the service providers we may use to operate Cora. We keep this list up to date; the legally binding description of the processing is in the privacy policy (categories + principles). Last updated: 2026-08-12.
| Service provider | Purpose | Processing region | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, storage of accounts/profiles/content | EU (Ireland) | Processing in the EU; DPA |
| Vercel | Hosting/operation of website and apps, server logs | EU function region (provider USA) | EU processing; DPA + SCC/DPF |
| Cloudflare | Image/video storage & delivery (Images, Stream), bot protection (Turnstile) | Global (provider USA) | DPA + SCC/DPF |
| Upstash | Rate limiting (short-lived counters keyed by user ID/IP) | EU (Frankfurt) | Processing in the EU; DPA |
| Sentry | Error and security monitoring (pseudonymous user ID, scrubbed error data) | EU | Processing in the EU; DPA |
| Resend | Sending transactional emails | EU (Ireland) | EU processing; DPA (pre-signed) |
| OpenAI | AI-assisted classification, text analysis, score support, AI assistant | USA | DPA + SCC/DPF; no model-training use |
| Sign-in via Google Sign-In (Identity Services) | Global (provider USA) | DPF/SCC | |
| Microsoft 365 | Email inboxes (contact@, privacy@, support@) | EU (EU Data Boundary) | Microsoft product terms / DPA |
Notes:
- "DPA" = data processing agreement (Art. 28 GDPR). "SCC" = standard contractual clauses, "DPF" = EU-U.S. Data Privacy Framework (Art. 44 et seq. GDPR).
- On the pure marketing website, no third-party analytics or marketing services are used at present.
- Changes to this list are documented here; material changes to the processing are also reflected in the privacy policy.