Sub-processors
Convenience translation – the German version is binding. Deutsche Fassung
As of: October 2026 · Annex 2 to the Data Processing Agreement of Founders1 GmbH · Convenience translation – the German version is binding
We engage the sub-processors listed below to provide our services. With each of them we have concluded an agreement under Art. 28 GDPR that binds it to confidentiality and to the requirements of the GDPR and extends these obligations to its own subcontractors. Sub-processors that receive Client Matter Data are additionally bound to secrecy under § 203 StGB (German Criminal Code); this does not apply to Microsoft and MongoDB, which do not offer such an undertaking and have no standing access.
All sub-processors are established in the European Economic Area (EEA), and personal data are stored and processed exclusively there. The sole exception is support access by Microsoft and MongoDB: such access is technically blocked (Customer Lockbox for Microsoft Azure, blocking of support access in MongoDB Atlas) and is possible only in critical incidents affecting operations or security, subject to our prior approval and for a limited time. Where such access takes place from a third country, it is based on the EU-US Data Privacy Framework or the Standard Contractual Clauses (SCCs) of the European Commission.
| Provider | Registered office | Purpose | Place of processing |
|---|---|---|---|
| Microsoft Ireland Operations Ltd | Dublin, Ireland | Cloud infrastructure and hosting of the platform; Azure OpenAI Service for extracting data from uploaded documents; Azure Document Intelligence for text recognition on identification documents | Germany (Germany West Central, Frankfurt); language model in the EU Data Boundary |
| MongoDB Limited | Dublin, Ireland | Database service (MongoDB Atlas) on the Azure infrastructure | Germany (Germany West Central, Frankfurt) |
| Company.info BI GmbH | Düsseldorf, Germany | Retrieval of public register and company data; screening against sanctions and watch lists, politically exposed persons and adverse media | Germany |
| Northdata GmbH | Hamburg, Germany | Retrieval of public register and company data | Germany |
| Doxis AI Solutions B.V. (formerly Klippa App B.V.) | Groningen, Netherlands | Text recognition on identification documents; no storage beyond the scanning process | Netherlands |
| SIA „Verifeye Online“ | Riga, Latvia | Automated identity and document verification | Latvia |
| Kerberos Compliance GmbH | Cologne, Germany | Expert review of complex ownership structures, identification of beneficial owners | Germany |
| Burkom Solutions GmbH | Augsburg, Germany | Connection to the DATEV interfaces | Germany |
| Scoria Labs GmbH | Munich, Germany | Defence against automated access during form submissions; technical metadata only, no client matter content | Germany |
Not all sub-processors are involved in every customer relationship. The sub-processors applicable to your contract are set out in your Data Processing Agreement.
Changes
We notify our customers in text form of the addition or replacement of a sub-processor at least 30 days in advance. Customers may object on objective grounds within 30 days of receipt of the notification; the details are governed by the Data Processing Agreement.
Changes from the 11/2025 version:
-
OpenAI, L.L.C. removed. Processing with language models is carried out via Microsoft’s Azure OpenAI Service (see Microsoft Ireland Operations Ltd); there is no contractual relationship with OpenAI.
-
Klippa App B.V. now trades as Doxis AI Solutions B.V.
-
Place of processing for Microsoft and MongoDB specified: Azure region Germany West Central (Frankfurt).
-
Column “Place of processing” added.
The service providers we use to operate our website betterco.ai are listed in our Website Privacy Notice.