Promptic GmbH
Subprocessors
Effective date: September 11, 2026
This page lists the subprocessors and material service providers Promptic uses to provide, secure, support, and bill for the Promptic service.
1. Overview
Promptic engages the following subprocessors and service providers to operate the service. The exact processing depends on the features a customer uses, the providers configured by the customer, and the deployment environment. Customer-selected model providers are used only when configured or requested by Customer.
Promptic requires subprocessors to protect personal data under written contractual, technical, and organizational safeguards. For international transfers, Promptic relies on adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, Data Privacy Framework certifications where applicable, data processing agreements, encryption, access controls, and vendor due diligence.
2. Current subprocessors and providers
| Provider | Purpose | Data processed | Location and safeguards |
|---|---|---|---|
| Vercel | Hosting, serverless functions, deployment platform, web analytics, BotID detection on signup and newsletter requests when enabled, Vercel Blob object storage where configured, and AI Gateway routing for managed models. | Website and application traffic, deployment logs, request and browser signals used for BotID detection, analytics reports, uploaded images/files where Vercel Blob is used, operational data, and prompts, model inputs, outputs, and request metadata when AI Gateway is used. | Production serverless functions are configured for Frankfurt. Managed Gateway calls prohibit prompt training. EU routes enforce zero data retention. US and Global routes prefer zero data retention but may allow provider retention when unavailable. EU and US routes pin provider inference to the selected region; Global routes may be processed in any available region. Vercel offers a DPA and subprocessors under GDPR transfer safeguards. |
| Neon | Managed PostgreSQL database hosting. | Account data, organization/AI Application data, customer content, traces, evaluations, usage ledger records, and product data stored in the application database. | Production database is configured in Neon's Germany region with point-in-time restore history configured to seven days. Neon offers a DPA and cross-border transfer safeguards. |
| Microsoft Azure | Service Bus job queues, backend worker infrastructure, Key Vault, Container Apps, Container Apps Sandboxes, Container Registry, optional Azure Blob Storage, and optional Azure Monitor/Application Insights. | Optimization job messages, secrets, logs, telemetry, container images, application runtime metadata, optional uploaded files, and instructions, inputs, predictions, traces, artifacts, generated code, and generated outputs processed during isolated evaluation or managed execution. | Production Azure resources are primarily configured in West Europe. Isolated evaluation and managed execution workloads use ephemeral Azure Container Apps Sandboxes with invocation-scoped data, bounded resources, no ingress, default-deny network controls, and provider-managed credential injection. Microsoft offers enterprise data protection terms and EU Data Boundary commitments subject to documented limitations. |
| OpenAI | Platform-managed AI model processing. | Prompts, examples, variables, schemas, traces or span content, evaluator content, and model inputs/outputs needed for requested AI operations. | Promptic uses its OpenAI project configured for Europe and OpenAI API data controls, including no default training on API inputs and outputs and Modified Abuse Monitoring for eligible API processing. |
| Stripe | Always-on billing, payment processing, checkout, subscriptions, invoices, tax, payment-method metadata, fraud prevention, and customer portal operations. | Billing contacts, customer identifiers, subscription data, transaction data, invoice data, payment method metadata, fraud-prevention signals, tax data, and support interactions related to billing. | Stripe Payments Europe Limited and Stripe affiliates process payment data under Stripe's privacy terms, DPA, service-provider list, and transfer safeguards. |
| Resend | SMTP email delivery. | Email addresses, names where included, message metadata, and email content for verification, authentication, invitations, transactional notices, and operational notifications. | Resend publishes a DPA and transfer safeguards, including Standard Contractual Clauses. |
| Better Stack | Monitoring, logging, uptime, error tracking, incident response, and operational diagnostics. | Application logs, error data, request metadata, uptime events, monitoring signals, and incident diagnostics. | Better Stack publishes privacy and security terms, including GDPR information and EU-region storage statements for relevant data. |
| GitHub | Optional OAuth sign-in. | OAuth account ID, profile data, email address, token metadata, and scopes when a user chooses GitHub sign-in. | GitHub publishes privacy and data protection terms. |
| Optional OAuth sign-in. | OAuth account ID, profile data, email address, token metadata, and scopes when a user chooses Google sign-in. | Google publishes privacy and data protection terms for OAuth services. | |
| Google AI (customer configured) | Optional customer-configured Google AI provider access. | Customer-provided Google credentials and model inputs, outputs, and metadata for requested calls. | Customer is responsible for the terms, location, retention, and safeguards of customer-configured Google AI processing. |
| Google Cloud EMEA Limited | Customer-configured Vertex AI inference where Customer supplies its own Google credentials. | Model inputs, outputs, and metadata needed for model inference. | Google is used through customer-configured credentials; platform-managed Claude and Gemini routes use Vercel AI Gateway. |
| Microsoft | Optional OAuth sign-in and optional Azure OpenAI access. | OAuth profile/email data for sign-in; model inputs/outputs and configuration data when Azure OpenAI is configured. | Microsoft publishes privacy, product, and data protection terms. Customer is responsible for customer-configured Azure OpenAI processing. |
| Amazon Web Services EMEA SARL | Direct platform-managed model inference through regional Amazon Bedrock Mantle. | Model inputs, outputs, and metadata needed for model inference. | Promptic publishes only reviewed models returned by the regional European Mantle catalog and excludes global and non-European routes. |
| OpenRouter and customer-selected model providers | Customer-configured OpenRouter and other customer-configured AI provider access. | Only the prompts, inputs, outputs, metadata, and configuration needed for model calls requested, enabled, or configured by Customer. | OpenRouter routing is disabled unless Customer enables it for an AI application or model call. Underlying model providers may also process data depending on the selected route. For Promptic-operated routing, these providers are Promptic subprocessors subject to our DPA obligations. Customers independently contracting with a provider are responsible for their separate provider agreement and settings; Promptic remains responsible for its own integration and processing. |
| Object storage providers where configured | Storage and delivery of uploaded images, organization logos, profile images, and similar files. | Uploaded files, object metadata, content type, randomized file names, and public or private object URLs depending on provider configuration. | The active provider may be Vercel Blob, Azure Blob Storage, or S3-compatible storage depending on deployment configuration. |
3. Updates and objections
Promptic will provide notice of intended additions or replacements of subprocessors by updating this page and notifying affected active customers by email or in-product notice at least 30 calendar days before the new subprocessor processes Customer Personal Data. Unless a customer agreement states otherwise, customers may object on reasonable data protection grounds during the notice period by contacting hello@promptic.eu. A shorter period requires the customer's specific authorization or a binding legal requirement, with notice as soon as legally permitted.
If an objection cannot be resolved, the customer may stop using the affected service feature or terminate the affected service without a termination penalty and receive a pro-rata refund of unused prepaid fees for that service, as described in our DPA.
4. Customer-selected providers
- Customer-selected AI providers are not enabled by default unless Promptic or Customer configures them for the relevant AI application, model, or experiment.
- If Customer uses BYOK or custom provider URLs, Customer instructs Promptic to send Customer Personal Data to that provider and remains responsible for the provider's terms, data residency, retention, training, and transfer safeguards.
- Customer should not submit personal or sensitive data to a provider unless Customer has confirmed the provider is appropriate for that data and use case.