Source of truth: the same list as in the privacy statement (section "Subverwerkers"); an automated check keeps the two identical.
This document states for each party what it does, where it processes data and what the status of the data processing agreement is — including where that is still open. Nowhere does it say "DPA signed" unless that has been recorded as evidence in the compliance register; as of 16-10-2026 that is the case only for the servers of Hetzner. The data processing agreement (DPA) for the mail hosting with Hetzner was concluded on 16-10-2026; the evidence thereof is still to be recorded in the register.
| Party | Purpose | Country | Data processing agreement (status 17-10-2026) |
|---|---|---|---|
| Anthropic | Execution of agent tasks (the language model behind each agent), via the services of Anthropic. | United States | Offers a data processing agreement with EU standard contractual clauses; acceptance by Stilops not yet recorded as evidence — open. |
| Hetzner Online GmbH | Hosting of the servers on which Stilops and customer data run. | Germany (EU) | Processing within the EU. DPA (Art. 28 GDPR) version 1.2 concluded via the Hetzner account, dated by Hetzner 22-9-2026; the PDF has been archived as evidence and recorded in the register — accepted, evidence archived. |
| Hetzner Online GmbH (e-mail) | E-mail hosting of Stilops itself (Hetzner Webhosting): the sender account for transactional e-mail to customers (password reset, registration confirmation, invitations, ticket replies, decision notifications) and the mailboxes of Stilops' internal agents. Customer agents have no mailbox and do not send e-mail. Cold outreach to prospects via this host is not a given (Hetzner Webhosting does not permit bulk mail) and requires a separate decision. | Germany (EU) | Processing within the EU. DPA (Art. 28 GDPR) concluded via the Hetzner account for the mail hosting on 16-10-2026, including communication data (e-mail) — concluded; evidence still to be recorded in the register. |
| Cloudflare, Inc. | DNS and traffic protection for the domains of Stilops. | United States | Offers a DPA with EU standard contractual clauses; acceptance not yet recorded as evidence — open. |
| Stripe | Payments and invoicing data for a paid subscription. | United States / Ireland | Offers a DPA with EU standard contractual clauses; acceptance not yet recorded as evidence — open. |
| Kadaster (PDOK Locatieserver) | Converting Dutch addresses into coordinates when a customer agent with route planning calculates a route using the route tool; only the address line, no names (since 17-10-2026). | Netherlands (EU) | Public government service; no data processing agreement offered. Receives only address lines without a name — decided by Fabian 17-10-2026. |
What a customer may expect from this
- If this list changes (new party, different country, different arrangement), the privacy statement changes accordingly and receives a new version number. A check in the repository enforces that the names in both sources remain identical.
- A customer who objects to a sub-processor can report this via [email protected].
- Until 16-10-2026, Stilops' e-mail ran via MXroute (United States), without a data processing agreement and without a transfer mechanism. Since that date, all e-mail runs via Hetzner in Germany. MXroute still holds the e-mail from before the switch. A final transfer and the termination are still in progress; after that, MXroute will no longer be used for personal data, and Stilops will then ask MXroute to confirm the deletion of mailboxes and domain in writing.
- The browser vendor (Google for Chrome, Microsoft for Edge) processes audio for the voice functions (dictation, meeting recording) on the user's own device; that audio does not reach Stilops. This is stated in the privacy statement, but is not a sub-processor of Stilops within the meaning of Art. 28 GDPR and is therefore not included in the table.
What needs to happen to close the open items
- For Anthropic, Cloudflare and Stripe (Hetzner servers were completed on 11-10-2026, Hetzner mail on 16-10-2026): accept the DPA offered (usually a click in the supplier's customer portal), archive the accepted version as a PDF and set the reference as evidence on the controls
iso27001:A.5.23,nis2:art.21(2)(d)andnen7510:5.22. - MXroute is closed: on 16-10-2026 the e-mail was transferred to Hetzner (EU) with a data processing agreement. What still follows: recording the DPA evidence for the mail hosting in the register; completing the final transfer and the termination with MXroute, and then having the deletion of mailboxes and domain confirmed in writing.