Skip to main content

Hosting & subprocessors

This page documents where Sally AI hosts your data, which subprocessors we use, and the contractual safeguards behind every data flow. Meeting content, transcripts and metadata are hosted exclusively in German data centers at Hetzner, with no third-country transfers. Use this page for vendor assessments, due-diligence reviews, or to confirm where each data category is processed. You can review or object to subprocessor changes at any time.

Our Germany hosting​

All meeting content, transcripts and metadata are hosted exclusively in German data centers at Hetzner. No third-country transfers, no non-German EU regions. Sally runs on its own large language model, operated end-to-end inside our own infrastructure in Germany.

Subprocessors for meeting data​

The following subprocessors are engaged under Art. 28 GDPR and process data from meetings on behalf of the controller. Processing takes place exclusively in data centers in Germany.

Hetzner Online
Hetzner Online
Cloud infrastructure / hosting / backups
Germany
DeepL
DeepL
AI-powered translation
Germany
Strato
Strato
Web hosting and infrastructure
Germany
Info

The continuously updated full subprocessor list is maintained in Annex 3 of the DPA.

Service providers for our own contractual relationship​

The following service providers have no access to meeting content, transcripts or associated metadata. They are used exclusively to handle our own contractual relationship with our customers. In this respect, we act as the controller under the GDPR. Processing takes place exclusively within the European Union.

Stripe
Stripe
Payment processing and transaction management
Ireland

What we guarantee​

  • Meeting content, transcripts and metadata are processed and stored exclusively in German data centers at Hetzner
  • Sally runs on its own LLM, operated inside our own infrastructure in Germany, without external AI providers
  • Data never leaves the EU, under any circumstances
  • We never use providers outside the EU, regardless of contractual safeguards

For organizations with the highest data sovereignty requirements, we offer additional flexibility:

  • On-premises data storage: Sally AI can store data in the customer's own database (MS SQL) on-premises, so your data never leaves your own infrastructure
  • Customer-provided LLMs: If your organization operates its own language models, Sally AI can be configured to use them exclusively, ensuring that no data is sent to any AI service outside your infrastructure

Contractual safeguards​

  • Data Processing Agreements (DPAs) are in place with all subprocessors, and their obligations mirror the main DPA
  • Standard Contractual Clauses (SCCs) are not required because no data leaves the EU
  • Any future exception would require explicit customer agreement and full compliance with GDPR Articles 44 to 49

Transparency & your review rights​

  • Advance notice and right to object to any subprocessor changes
  • Audit and inspection rights, including access to certifications and third-party audit reports
  • Full transparency about where your data is processed at all times