Legal

Sub-processors

Effective date: July 30, 2026
Source: Annex III of the DPA

This page lists every third party that processes customer data on IronMemo's instructions. It mirrors Annex III of our Data Processing Agreement, which is the authoritative schedule: if the two ever differ, the DPA governs.

IronMemo is a cloud service with a single storage location. Customer data is stored in Austria; the AI providers below process data in the United States, and in Ireland for certain OpenAI operations. Retention differs per provider, so it is stated per provider rather than as one number.

Infrastructure and hosting

netcup

Legal entity: netcup GmbH (part of the Anexia group)
Service provided: Server and storage infrastructure. netcup provides the underlying servers; IronMemo administers the operating system and the application layer.
Data categories transferred: All data the Service stores: account data, meeting content, transcripts, summaries, uploaded files, logs and backups.
Country of the legal entity: Germany
Processing location: Austria (European Economic Area)
Storage location: Austria (European Economic Area)
Default retention at the provider: For as long as the data exists in the Service. Deletion in IronMemo removes it from netcup storage; backups expire on a 30-day cycle.
Reduced retention / no-logging: Not applicable.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: Not required. Data stays inside the European Economic Area.
Added: Initial schedule, at launch
Provider's own sub-processors: Not separately identified in our schedule.

Speech-to-text

ElevenLabs

Legal entity: Eleven Labs Inc.
Service provided: Speech-to-text transcription.
Data categories transferred: Audio and video submitted for transcription.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: The provider's own retention applies by default.
Reduced retention / no-logging: Available only on an eligible enterprise configuration and after account-level verification. Not assumed to be on.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

AssemblyAI

Legal entity: AssemblyAI Inc.
Service provided: Speech-to-text transcription.
Data categories transferred: Audio and video submitted for transcription.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Configurable; the provider's default deletion and retention terms apply otherwise.
Reduced retention / no-logging: Configurable. Note that the provider's standard terms permit certain de-identified use unless configured otherwise.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Third-party cloud infrastructure and the provider's own sub-processors, published by the provider.

Large-language-model processing

OpenAI

Legal entity: OpenAI OpCo, LLC; OpenAI Ireland Ltd
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Processing location: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Storage location: United States. OpenAI Ireland Ltd for certain non-US processing where enabled.
Default retention at the provider: Inputs and outputs are not used for training by default; abuse-monitoring logs may be kept for a limited period, by default up to 30 days.
Reduced retention / no-logging: Available on an approved reduced-retention or modified-monitoring configuration.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Google

Legal entity: Google LLC
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: On the paid API and Vertex AI, inputs and outputs are not used to improve Google's products; abuse-monitoring retention applies by default, currently up to 55 days. Certain stateful features may involve additional storage.
Reduced retention / no-logging: Available on an approved reduced-retention configuration for the project.
Use for model training: Not permitted. Our agreement forbids using customer content to train, fine-tune or improve the provider's models.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

xAI

Legal entity: X.AI LLC
Service provided: Summaries, action items, AI chat.
Data categories transferred: Transcripts and text submitted for summaries, action items and AI chat, together with the generated output.
Country of the legal entity: United States
Processing location: United States
Storage location: United States
Default retention at the provider: Inputs and outputs are not used to train foundation models by default; content is retained temporarily, by default up to 30 days.
Reduced retention / no-logging: Available on an approved reduced-retention configuration. Outside such a configuration the provider may create and use de-identified or aggregated data.
Use for model training: Not permitted for foundation-model training. This provider is not used for data originating from the EEA, the United Kingdom or Switzerland.
Transfer mechanism: EU Standard Contractual Clauses.
Added: Initial schedule, at launch
Provider's own sub-processors: Published by the provider.

Payments

Stripe processes payments, invoices, fraud prevention and tax as an independent controller under its own privacy policy, not as a sub-processor of customer content. Card details are held by Stripe and never reach IronMemo's systems.

Changes to this list

We notify account owners and enterprise administrators at least 30 days before a new sub-processor starts processing customer data.
The notice names the provider, its purpose, the processing region and the start date.
You may raise a reasoned data-protection objection during that period. We look for a workable alternative, and where none exists you may terminate the affected part of the Service.
A provider may be replaced faster only in a documented security emergency, with a separate justification.

Questions

Write to dpa@ironmemo.com for the DPA or a sub-processor question, and to security@ironmemo.com for a security review or a vulnerability report. Requests about your own personal data go to dsar@ironmemo.com.