Legal

Sub-processors

Effective date: September 19, 2026
Source: Annex III of the DPA

This page lists every third party that processes customer data on IronMemo's instructions. It mirrors Annex III of our Data Processing Agreement, which is the authoritative schedule: if the two ever differ, the DPA governs.

IronMemo is a cloud service with a single storage location. Customer data is stored in Austria; the AI providers below process data in the United States, and in Ireland for certain OpenAI operations. Retention differs per provider, so it is stated per provider rather than as one number.

Infrastructure and hosting

netcup

Legal entity: netcup GmbH (part of the Anexia group)
Service provided: Server and storage infrastructure. netcup provides the underlying servers; IronMemo administers the operating system and the application layer.
Data categories transferred: All data the Service stores: account data, meeting content, transcripts, summaries, uploaded files, logs and backups.
Country of the legal entity: Germany
Processing location: Austria (European Economic Area)
Storage location: Austria (European Economic Area)
Default retention at the provider: For as long as the data exists in the Service. Deletion in IronMemo removes it from netcup storage; backups expire on a 30-day cycle.
Reduced retention / no-logging: Not applicable.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: Not required. Data stays inside the European Economic Area.
Added: Initial schedule, at launch
Provider's own sub-processors: Not separately identified in our schedule.

Speech-to-text

ElevenLabs

Legal entity: Eleven Labs Inc.
Service provided: Speech-to-text transcription.
Data categories transferred: Audio and video submitted for transcription.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: The provider's own retention applies by default.
Reduced retention / no-logging: Available only on an eligible enterprise configuration and after account-level verification. Not assumed to be on.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

AssemblyAI

Legal entity: AssemblyAI Inc.
Service provided: Speech-to-text transcription.
Data categories transferred: Audio and video submitted for transcription.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Configurable; the provider's default deletion and retention terms apply otherwise.
Reduced retention / no-logging: Configurable. Note that the provider's standard terms permit certain de-identified use unless configured otherwise.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Third-party cloud infrastructure and the provider's own sub-processors, published by the provider.

Large-language-model processing

OpenAI

Legal entity: OpenAI OpCo, LLC; OpenAI Ireland Ltd
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Processing location: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Storage location: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Default retention at the provider: Inputs and outputs are not used for training by default; abuse-monitoring logs may be kept for a limited period, by default up to 30 days.
Reduced retention / no-logging: Available on an approved reduced-retention or modified-monitoring configuration.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Google

Legal entity: Google LLC
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: On the paid API and Vertex AI, inputs and outputs are not used to improve Google's products; abuse-monitoring retention applies by default, currently up to 55 days. Certain stateful features may involve additional storage.
Reduced retention / no-logging: Available on an approved reduced-retention configuration for the project.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

xAI

Legal entity: X.AI LLC
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Inputs and outputs are not used to train foundation models by default; content is retained temporarily, by default up to 30 days.
Reduced retention / no-logging: Available on an approved reduced-retention configuration. Outside such a configuration the provider may create and use de-identified or aggregated data.
Use for model training: Not permitted for foundation-model training. This provider is not used for data originating from the EEA, the United Kingdom or Switzerland.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Embeddings and semantic search

DeepInfra

Legal entity: Deep Infra Inc.
Service provided: Vector embeddings of transcript and document text, used for search and AI chat over the workspace.
Data categories transferred: Text fragments of transcripts, summaries and uploaded documents submitted for embedding, together with the resulting vectors.
Country of the legal entity: United States
Processing location: United States
Storage location: Not stored by the provider. The vectors are returned to IronMemo and stored on our own infrastructure in Austria.
Default retention at the provider: Zero data retention under the provider's terms: the submitted text is not stored, sold or used for training.
Reduced retention / no-logging: Not applicable - zero retention is the default.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: July 24, 2026
Provider's own sub-processors: Published by the provider.

Transactional email and SMS

Resend

Legal entity: Plus Five Five, Inc., trading as Resend
Service provided: Delivery of transactional email: sign-in links, security alerts, service notices.
Data categories transferred: Recipient email address, sender, subject and the body of the message, delivery metadata.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Message and delivery logs per the provider's own published period.
Reduced retention / no-logging: Not assumed to be on.
Use for model training: Not permitted.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

GatewayAPI

Legal entity: ONLINECITY.IO ApS (CVR 27364276), which operates GatewayAPI
Service provided: Delivery of one-time codes by SMS.
Data categories transferred: Recipient phone number and the text of the one-time code message.
Country of the legal entity: Denmark
Processing location: European Union. The provider offers an EU setup in which the message is handled by EU-based infrastructure and EU carriers.
Storage location: European Union.
Default retention at the provider: Traffic logs per the provider's own published period.
Reduced retention / no-logging: The provider offers a mode in which message content, sender and recipient are not written to traffic logs.
Use for model training: Not applicable.
Transfer mechanism: Not required for the EU setup. Data stays inside the European Economic Area.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Twilio

Legal entity: Twilio Inc.; Twilio Ireland Limited for customers in the European Economic Area
Service provided: Delivery of one-time codes by SMS on routes GatewayAPI does not cover.
Data categories transferred: Recipient phone number and the text of the one-time code message.
Country of the legal entity: United States. Twilio Ireland Limited, Dublin, for EEA contracting.
Processing location: United States.
Storage location: United States.
Default retention at the provider: Message records per the provider's own published period; message bodies can be redacted in the provider's console.
Reduced retention / no-logging: Available as a provider setting.
Use for model training: Not applicable.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Error tracking

Sentry

Legal entity: Functional Software, Inc., doing business as Sentry
Service provided: Application error and performance monitoring.
Data categories transferred: Error reports: stack traces, request metadata, IP address, user or workspace identifier. Meeting content is not sent deliberately and may appear only if it is quoted inside an error message.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Event retention per the provider's plan, by default 90 days.
Reduced retention / no-logging: Data scrubbing is enabled so that recognised secrets and personal data are stripped before the event is stored.
Use for model training: Not permitted.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Website analytics and advertising

The three vendors below never receive meeting content or workspace data. They process website visitor data on ironmemo.com, where IronMemo is an independent controller rather than a processor, which is why they sit outside Annex III of the DPA in the same way Stripe does. They are listed here because they do receive personal data and a reader of this page is entitled to know who. What they set and when is described in the Cookie Policy.

Google Analytics 4 and Google Ads conversion measurement - Google LLC (United States); Google Ireland Limited where the contracting Google entity is in the European Economic Area. Purpose: website usage statistics and measurement of paid advertising. Data categories: pageviews, referrer, device and browser, approximate location from IP, click identifiers. Transfer mechanism: EU Standard Contractual Clauses. The tags load in cookieless Consent Mode before a choice is made and set cookies only after Accept All, with the one paid-landing exception described in the Cookie Policy.
Yandex Metrica - YANDEX, LLC, 16 Lva Tolstogo St., Moscow 119021, Russia; for visitors covered by the GDPR the service is offered by Air Smart Advertising Solutions FZ-LLC under the Metrica terms of use. Purpose: website usage statistics, click mapping and session replay (Webvisor), which records interactions with public pages including text typed into forms. Data categories: pageviews, referrer, device and browser, approximate location from IP, recorded interactions. The script is not loaded at all until a visitor chooses Accept All. Transfer mechanism: EU Standard Contractual Clauses. There is no European Commission adequacy decision for the Russian Federation, so a transfer there rests on the Clauses and on the visitor's consent.

Payments

Stripe processes payments, invoices, fraud prevention and tax as an independent controller under its own privacy policy, not as a sub-processor of customer content. Card details are held by Stripe and never reach IronMemo's systems.

Changes to this list

We notify account owners and enterprise administrators at least 30 days before a new sub-processor starts processing customer data.
The notice names the provider, its purpose, the processing region and the start date.
You may raise a reasoned data-protection objection during that period. We look for a workable alternative, and where none exists you may terminate the affected part of the Service.
A provider may be replaced faster only in a documented security emergency, with a separate justification.

Questions

Write to dpa@ironmemo.com for the DPA or a sub-processor question, and to security@ironmemo.com for a security review or a vulnerability report. Requests about your own personal data go to dsar@ironmemo.com.