Subprocessors
Version 1.0 · Last updated 13 September 2026 · Canonical URL: https://airhive.ai/legal/subprocessors
1. Purpose and scope
This document identifies every third-party service provider that Airhive GmbH, Eckernwoort 16, 22607 Hamburg, Germany ("Airhive") appoints to process Customer Personal Data or other personal data on its behalf in connection with the Service. It forms part of the Data Processing Agreement (Annex 3) and is to be read together with the Privacy Policy. The list is complete as at the effective date shown above.
2. Current Subprocessors
| Provider (legal name) | Seat | Services | Data processed | Sees Customer Content | Processing location and safeguards |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | Cloud infrastructure, compute, hosting and encrypted file storage for the Service. | Customer Content, Account data, metadata and technical logs required to host and secure the Service. | Yes (encrypted at rest; no access in the ordinary course of business). | Data centres in Germany (EU). Data-processing agreement under Article 28 GDPR in place. No third-country transfer. |
| Amazon Web Services EMEA SARL | Luxembourg | Object storage for encrypted backups. | Encrypted backup copies of Customer Content, metadata and databases. | Yes, in encrypted form only (keys held by Airhive). | EU region only (eu-central-1, Frankfurt, Germany). AWS Data Processing Addendum under Article 28 GDPR in place. No third-country transfer of Customer Content; AWS may access limited service metadata from outside the EU for support only on Airhive's request, under the Standard Contractual Clauses included in the AWS DPA. |
| Mistral AI SAS | Paris, France | AI processing supporting document classification, naming, extraction, document chat and related AI Features. | Selected document text, prompts, metadata and Generated Output required for the enabled feature; transmitted per request and not retained by the provider beyond processing. | Yes (per request, for the enabled feature only). | EU (France). Data-processing agreement under Article 28 GDPR in place, including a contractual prohibition on training on Customer Content. No third-country transfer. |
| Mollie B.V. | Amsterdam, Netherlands | Subscription payment processing and related transaction information. | Billing name and address, email, payment method details, transaction references and amounts. Airhive does not receive or store full card details. | No. | EU (Netherlands). Acts as Airhive's processor for payment processing and, for fraud prevention, anti-money-laundering, payment-network and regulatory compliance, as an independent controller under its own privacy notice. No third-country transfer by Airhive. |
3. Airhive personnel and support access
Access to production systems containing Customer Personal Data is restricted to named Airhive personnel located in the EU/EEA. No personnel or contractors located outside the EU/EEA have access to production systems or Customer Content.
4. Customer-selected Connected Services
A third-party service selected and connected by a Customer under the Customer's own account or contract, including an external AI assistant, cloud-storage service, identity provider or workflow tool, is not an Airhive Subprocessor merely because Airhive transmits data to it at the Customer's direction. The Customer is responsible for assessing and authorising that provider. If Airhive separately appoints the provider to process Customer Personal Data as part of the Service, the provider will be added to this list.
5. Subprocessor obligations
- Airhive requires each Subprocessor to process Customer Personal Data only for the agreed services and documented instructions.
- Subprocessors are bound by written data-processing terms covering confidentiality, security, breach notification, deletion, assistance and onward subprocessing.
- No Subprocessor may use Customer Content to train, fine-tune or improve any artificial-intelligence or machine-learning model.
- Where processing would involve a restricted transfer outside the EU/EEA, Airhive implements an appropriate transfer mechanism, including Standard Contractual Clauses and supplementary measures where required, before the transfer takes place. As at the effective date, no such transfer takes place.
- Airhive remains fully liable for the performance of its Subprocessors' obligations in accordance with Article 28(4) GDPR.
6. Changes and objections
Airhive will give Customers subject to the DPA at least 30 days' advance notice by email to the Account email address of the Customer's Administrators, and through the Service, before adding or replacing a Subprocessor that processes Customer Personal Data, except where an urgent replacement is necessary to protect security, availability or legal compliance. A Customer may object during the notice period on reasonable data-protection grounds. Airhive will work in good faith to resolve the objection. If no reasonable solution is available, the Customer may terminate the affected Service in accordance with Section 11 of the DPA.
7. Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | [EFFECTIVE DATE] | First published version. |
8. Contact and notifications
Questions, and requests to receive Subprocessor change notifications at an additional email address, may be sent to privacy@airhive.ai.