Sub-processors ​
Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.
This list belongs to the data processing agreement for the hosted (Enterprise) edition, where Quavon UG (haftungsbeschränkt) is the processor. In the self-hosted edition the customer contracts model providers and hosting directly; the same table then helps the customer fill in its own records.
Third parties are named by company and service only.
How model routes work ​
CodeLotse sends prompts (pull request diffs, issue and comment text, code excerpts) only to the model provider and endpoint that the tenant configured for a feature and model tier. A provider the tenant did not configure receives nothing. Each tenant uses its own credentials (bring your own key); provider clients never fall back to the operator's credentials (threat model I5). The provider kinds are the values of LlmProvider in packages/shared-types/src/llm.ts.
The hosted edition is always bring your own key, on every plan: Quavon UG (haftungsbeschränkt) never supplies, resells or pays for model calls. The tenant has its own contract with the model provider it chooses, and that provider is the tenant's own processor, not a sub-processor of Quavon UG (haftungsbeschränkt). The table below therefore lists no sub-processor of Quavon UG (haftungsbeschränkt); it helps the tenant fill in its own records. The DPO confirms this qualification.
Model providers (per route) ​
The "no training" and retention statements below summarise the providers' own documentation as of October 2026. They change; check the linked pages and the provider's current data processing agreement before relying on them.
Provider kind (LlmProvider) | Company and service | Data sent | Processing location | No-training and retention settings (provider documentation) | EU-only option |
|---|---|---|---|---|---|
openai | OpenAI, OpenAI API | Prompts and completions for the configured features | Global by default; Europe for projects created with European data residency | API data is not used for training unless the customer opts in. Zero data retention is available on request for eligible endpoints; European-residency projects are handled in-region with zero data retention (OpenAI) | Yes: an API project created with the Europe region |
anthropic | Anthropic, Claude API | As above | Not EU-resident when used directly (per provider documentation; verify) | Commercial terms exclude training on customer content. Zero data retention is available on request and does not cover every API feature (Anthropic commercial terms, API and data retention) | Use the Amazon Bedrock route in an EU region instead |
azure_openai | Microsoft, Azure OpenAI in Azure AI Foundry | As above | The Azure region or EU Data Zone of the deployment | Prompts and completions are not used to train models; abuse monitoring may store data unless modified abuse monitoring is approved (Microsoft) | Yes: EU region or EU Data Zone deployment |
bedrock | Amazon Web Services, Amazon Bedrock | As above | The AWS region of the endpoint; cross-region inference profiles stay within their geography | Prompts and completions are not stored or used to train models, according to AWS (AWS) | Yes: EU region (for example Frankfurt) and EU inference profiles |
mistral | Mistral AI, Mistral AI API (La Plateforme) | As above | EU by default, according to the provider | Training on API data and its opt-out must be checked in the organisation's privacy settings and the provider's terms; sources disagree on the default. Zero data retention on request (Mistral AI help centre) | Yes (default EU endpoint) |
openai_compatible | Self-hosted or private model server (for example vLLM or Ollama) operated by the customer | As above | Where the customer runs it | Under the customer's control | Yes, if run in the EU |
For openai_compatible endpoints run by the customer there is no sub-processor (none). If the endpoint is a third-party service, the customer lists that company and service here.
Technical controls that support the provider settings ​
- Prompt logs are off by default; when a tenant enables debug logging they are redacted, encrypted and deleted after at most 7 days (data inventory).
- Secrets are redacted before logging, and outgoing published bodies are scanned for secrets (redact.test.ts, secrets.test.ts).
- Provider redirects are refused and model endpoints are checked against private and metadata addresses in the enterprise edition (endpoint-guard.test.ts).
- Bedrock ambient credentials are refused; each tenant's key is passed explicitly (client.test.ts).
EU-only routing ​
A tenant achieves EU-only processing by configuring only routes marked "Yes" above, in an EU region, for every feature and tier. CodeLotse does not yet enforce an "EU-only" policy switch that refuses non-EU routes; until it does, the tenant administrator is responsible for the configuration and the DPO should check it. This is listed in the review checklist.
Infrastructure (hosted edition) ​
| Company and service | Purpose | Data | Location |
|---|---|---|---|
| netcup, server hosting | Runs the hosted service (k3s cluster, Postgres, Valkey, backups) | All tenant data | Germany; data centre <to be confirmed from the contract> |
netcup is confirmed as the hosting provider of the hosted edition. The data centre location is taken from the contract once it is signed.
Email (hosted edition) ​
Owner verification emails and payment reminder emails are sent through an SMTP server that Quavon UG (haftungsbeschränkt) operates on its own infrastructure. It is not a third-party sub-processor. The server must be in the EU and the connection uses STARTTLS or TLS. Data: the owner email address and the verification link; for reminders, the invoice email of the billing account, the date the organisation becomes read-only and the payment link of the open invoice.
Billing (hosted edition) ​
| Company and service | Purpose | Data | Location |
|---|---|---|---|
| Mollie, payments and sales invoices | Collects subscription payments and issues invoices for Quavon UG (haftungsbeschränkt); processor or independent controller for payment data is for counsel | Company name, invoice email, address, VAT ID, tenant id as metadata, payment data, invoice recipient and amounts | EU |
| European Commission, VIES | VAT ID checks for reverse charge | Country code and VAT ID; the seller's VAT ID as requester | EU |
Other recipients that are not sub-processors ​
- The tenant's Git host (for example GitHub): CodeLotse reads from and publishes to the tenant's own repositories on the tenant's instruction. The Git host is a service the tenant uses directly.
- The tenant's identity provider for OIDC sign-in.
- The push service of a person's browser (Apple, Google, Mozilla or Microsoft), when that person turns on browser push. The browser chooses the service. It receives the subscription address, message timing and size, and a payload encrypted end to end that it cannot read (ADR-0020).
Change log ​
| Date | Change |
|---|---|
| 2026-10-13 | First draft |
| 2026-10-14 | Hosted edition is always bring your own key; Mollie and VIES added |
| 2026-10-14 | netcup (Germany) confirmed as hosting provider, data centre location still open; email through Quavon's own SMTP server, no third-party mail provider |
| 2026-10-15 | Browser push services added as recipients chosen by the person's browser |