TrompTechLast updated: 1 October 2026
What your business puts in the TrompTech Layer, TrompTech processes as processor. For this we use the parties below. This is the list required by Article 28(2) GDPR; what we do ourselves as controller is set out in the privacy statement.
Subprocessors
| Party | What for | Which data | Where | Basis for transfer |
|---|---|---|---|---|
| Strato AG | The server on which the Layer runs | Everything in the workspace | Germany | Not needed (EU) |
| Supabase Inc. | Logging in | Email address, encrypted password, sessions, and what Supabase logs in the process, such as IP addresses and login times | Database in Frankfurt; American company | Standard contractual clauses |
| Anthropic | The language model Claude, for the AI functions, until the move to the EU route below | What goes to the model per task: the question, the instructions and the data the AI retrieves from the workspace for that purpose | United States | Standard contractual clauses |
| OpenAI | The language model ChatGPT, only if an administrator chooses it for an agent, until the move to the EU route | As for Anthropic | United States | Standard contractual clauses |
| Google Cloud (Vertex AI) or AWS (Amazon Bedrock); the choice will follow | The EU route for the AI functions: the language model Claude from Anthropic, and with Google Cloud also Gemini from Google for light work such as sorting and summarising. Takes effect after the announcement below | As for Anthropic | A region in the EU; American company | EU-US Data Privacy Framework and standard contractual clauses |
| Resend Inc. | Sending and receiving mail on a custom domain, only if your business routes it via the Layer | Mail with content and attachments, and the addresses | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Storage of the nightly backups, outside the server | Encrypted archives of the workspace. They are encrypted on the server before they leave, and the keys are not held by Google | Chosen by Google | EU-US Data Privacy Framework |
The AI to the EU
We are moving the AI functions to processing in the EU: via Google Cloud (Vertex AI) or AWS (Amazon Bedrock), in a region in the EU. Which of the two it will be, and from when, we will email to the administrator of your workspace at least 30 days before the move takes effect. From then on, nothing for the AI functions goes to Anthropic or OpenAI in the United States any more. If the EU route is ever unavailable, the AI does not run: nothing then goes to a route outside the EU either. Where the AI of your workspace runs now, you can see in the Layer under Settings, AI.
Which language model does which work is set by the administrator. Your own key from Anthropic or OpenAI is only possible if TrompTech enables it for your workspace. That provider is then your own supplier and not a subprocessor of TrompTech, and that work runs outside the EU route.
Not a subprocessor
- Vercel runs the website tromptech.nl. The workspace and its data are not stored there.
- Integrations that your business switches on itself, such as Google, Microsoft 365, Mollie or a CRM, are services of your business. What happens there falls under your arrangements with that service.
- Public sources that the Layer consults with a Chamber of Commerce (KvK) number, VAT number or address: the Trade Register of the KvK, VIES of the European Commission and PDOK.
Changes and objections
If a subprocessor is added or changes, we email the administrator of your workspace at least 30 days in advance. If you object, let us know within that period. If we cannot reach agreement together, you can cancel the subscription with effect from the date of the change, without costs for the rest of the period.
Contact
Questions about this list: info@tromptech.nl. See also the privacy statement and the data processing agreement.