Sub-processors

Cloudflare

hosting of the application and rooms, transactional email delivery (login codes, notices when a passkey is added or removed), forwarding of incoming mail to enrosa.live (Email Routing), anti-abuse check on the login page (Turnstile), generation of the minutes PDF with Browser Run (the PDF is created on demand and not stored). United States; certified under the EU-U.S. Data Privacy Framework (DPF) and SCCs; EU jurisdiction for room and database data, not for the PDF generation.

Soniox

real-time speech-to-text (STT) and anonymous voice separation; the real-time API keeps no audio or transcripts. United States; DPA signed, transfer covered by standard contractual clauses (SCC).

OpenRouter

automatic translation of captions and writing of the minutes from the transcript text: routes requests only to the model providers listed here, headquartered in the United States or the EU, with zero data retention. United States; transfer covered by standard contractual clauses (SCC).

Translation and minutes model providers (via OpenRouter)

Fireworks, Together, BaseTen, DeepInfra, Crusoe and CoreWeave (United States; SCCs and, where certified, DPF), Inceptron (Sweden/Finland) and NextBit (Spain) (EU), all with zero data retention.

Microsoft Azure

second translation model, used in parallel with the first, and the model that writes and translates the minutes (the OpenAI model GPT-6 luna, via OpenRouter, with zero data retention, pinned to Microsoft's EU endpoint). United States; standard contractual clauses (SCC) and, where certified, DPF.

Stripe

payments and invoicing. Ireland / United States; EU-U.S. Data Privacy Framework (DPF) and SCCs.

Google Workspace

the mailboxes ciao@enrosa.live and admin@enrosa.live: emails written to support and their attachments. Ireland / United States (Google Ireland Limited and Google LLC); EU-U.S. Data Privacy Framework (DPF) and SCCs.

A-Cube

e-invoicing for the Italian market. Italy (EU); no transfer outside the EU.

Google

sign-in with Google, only if the organizer chooses it: Google Ireland Limited and Google LLC verify the identity as independent controllers and do not process room data on behalf of Enrosa. Ireland / United States; EU-U.S. Data Privacy Framework (DPF) and SCCs.