Sub-processors – CtxCore

Version 2.1 · 2026-10-11

This list is public and forms Annex IV of the Data Processing Agreement. Each entry states the products it is used for. CtxCore AB announces changes by email to the owner of each customer account at least 30 days in advance. The customer may object within this period; if the new sub-processor is engaged despite the objection, the customer may terminate the contract with effect from the date of the change.

A. Sub-processors for customer data

Hostinger

• Used for: all products (account and billing)
• Company: Hostinger International Ltd., Larnaca, Cyprus (EU)
• Processing location: Frankfurt am Main, Germany
• Purpose: server (VPS) for operating the products and CtxCore Account: database, uploaded files, interview transcripts, backups; CtxCore's own TURN server, which sets up and relays the voice connection of interviews
• Data: all data listed in Annex II of the Data Processing Agreement; for the TURN server the IP address of the browser, kept only in small, size-limited server logs that are continuously overwritten
• Transfer basis: no transfer to a third country; Hostinger's data processing agreement

Amazon Web Services – Amazon Bedrock

• Used for: CtxCore Brain
• Company: Amazon Web Services EMEA SARL, Luxembourg (EU); parent company Amazon.com, Inc., USA
• Processing location: EU; source region Frankfurt (eu-central-1), processing via an EU inference profile in AWS regions within the EU; re-ranking of search results runs in Frankfurt (eu-central-1) only
• Purpose: AI models provided through Amazon Bedrock: Claude models by Anthropic, Amazon Titan embeddings for search, and Cohere Rerank 3.5 by Cohere, which sorts search results by relevance; used to extract statements, assign Topics, compare with existing content, draft Rules, answer chat questions, conduct interviews and order search results
• Data: texts from documents, transcripts, Rules, Proposals, chat questions and search queries, including names contained in them; re-ranking receives only the search query and the texts of the Rules found
• Transfer basis: processing in the EU; AWS data processing addendum including the EU Standard Contractual Clauses; AWS does not use the content to train models

Amazon Web Services – Amazon Polly

• Used for: CtxCore Brain
• Company: Amazon Web Services EMEA SARL, Luxembourg (EU)
• Processing location: Frankfurt (eu-central-1)
• Purpose: speech output in interviews (text to voice)
• Data: the answer texts of the interview assistant
• Transfer basis: as for Amazon Bedrock

Deepgram

• Used for: CtxCore Brain
• Company: Deepgram, Inc., San Francisco, USA
• Processing location: Deepgram's EU endpoint (api.eu.deepgram.com); the country within the EU is not fixed
• Purpose: speech recognition in interviews (voice to text), live; CtxCore has opted out of Deepgram's model improvement programme
• Data: the audio stream of the interview, the recognised text, specialist terms of the Context
• Transfer basis: processing in the EU; because Deepgram is a US company, access from the USA cannot be ruled out; safeguard: EU Standard Contractual Clauses under Deepgram's data processing agreement

Amazon Web Services – Amazon SES

• Used for: all products (account and billing)
• Company: Amazon Web Services EMEA SARL, Luxembourg (EU)
• Processing location: Stockholm, Sweden (eu-north-1)
• Purpose: sending emails from the products (invitations, sign-in links, notifications) and from CtxCore Account
• Data: name, email address, content of the email (name of the Context, links, where applicable titles of Rules or Proposals in notifications); if an email bounces or the recipient complains, the recipient address is kept on a suppression list until CtxCore deletes it
• Transfer basis: as for Amazon Bedrock

Amazon Web Services – Amazon S3

• Used for: all products (account and billing)
• Company: Amazon Web Services EMEA SARL, Luxembourg (EU)
• Processing location: Frankfurt (eu-central-1)
• Purpose: second copy of the nightly backups, outside the Hostinger server: database backups (encrypted before upload with a key that is not kept on the server), uploaded files and interview transcripts; S3 encrypts all copies at rest; retention 14 days
• Data: all data listed in Annex II of the Data Processing Agreement
• Transfer basis: as for Amazon Bedrock

Further technical recipients without content data

• Let's Encrypt (TLS certificates): receives no personal data of users.
• Used for: all products (account and billing)

Not sub-processors of CtxCore

AI tools that the customer connects itself via MCP or pull (for example Claude, ChatGPT, Microsoft Copilot) are not sub-processors of CtxCore. The customer is responsible for the transfer to them (Data Processing Agreement, Part D.7).

B. Service providers for CtxCore as controller

Not part of Annex IV; listed for transparency. Details in the Privacy Policy.

Stripe

• Used for: all products (account and billing)
• Company: Stripe Payments Europe, Ltd., Dublin, Ireland
• Processing location: EU and USA (Stripe, Inc.)
• Purpose: payment, subscription, invoices, taxes, customer portal, card checks
• Data: company name, billing address, VAT ID, email address, payment method
• Role and basis: partly an independent controller for payment processing, otherwise a processor; Stripe's data processing agreement with its data transfers addendum; EU-US Data Privacy Framework

Amazon Web Services – Amazon SES

• Used for: all products (account and billing)
• Company and location: as above
• Purpose: emails from CtxCore Account (confirmation, sign-in links, reminders, status and quota notices)
• Data: name, email address, content of the email

Hostinger

• Used for: all products (account and billing)
• Company and location: as above
• Purpose: operation of CtxCore Account
• Data: account data, server logs

Amazon Web Services – Amazon S3

• Used for: all products (account and billing)
• Company and location: as above
• Purpose: backup copy of CtxCore Account
• Data: account data

Google Workspace

• Used for: all products (account and billing)
• Company: Google Cloud EMEA Limited, Dublin, Ireland
• Processing location: Google data centres; storage within the EU is not guaranteed
• Purpose: mailbox for emails to support@ctxcore.io and privacy@ctxcore.io
• Data: content and metadata of emails
• Role and basis: processor; Google's Cloud Data Processing Addendum including the EU Standard Contractual Clauses

European Commission (VIES)

• Used for: all products (account and billing)
• Location: EU
• Purpose: checking the VAT ID at sign-up
• Data: VAT ID, country
• Role: public authority, not a processor

Change history

Terms · Data Processing Agreement · Privacy