Sub-processors
Last changed 1 November 2026
When Corresso processes personal data for our customers, these companies help us do it. Each one we use works under a written data processing agreement with us (GDPR art. 28(4)).
Hetzner Online GmbH
Active- Purpose
- Hosting: the servers that run Corresso and hold its database
- Personal data
- Everything Corresso stores: accounts, conversations, notes and drafts
- Where
- Germany (EU)
- Address
- Industriestr. 25, 91710 Gunzenhausen, Germany
- Transfer safeguard
- None needed: the data stays in the EU
Plus Five Five, Inc. (Resend)
Active- Purpose
- Delivering Corresso's own email to the people who use it: confirmations, invitations and password resets
- Personal data
- Those messages (recipient, subject and text) and whether each was delivered or bounced
- Where
- USA
- Address
- 2261 Market Street #5039, San Francisco, CA 94114, USA
- Transfer safeguard
- EU-U.S. Data Privacy Framework (Plus Five Five, Inc. is certified under it), with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Resend’s data processing agreement as the alternative
- Keeps data
- Keeps sent messages and their delivery logs for 30 days
Anthropic Ireland, Limited, and Anthropic, PBC
Not yet activeEngaged only when this service is switched on, and not before every customer has had 30 days’ notice.
- Purpose
- Writing draft replies for a person to review, edit and send
- Personal data
- The text of the conversation a draft is written for, and the draft it returns
- Where
- USA (Anthropic, PBC)
- Address
- Anthropic Ireland, Limited: 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic, PBC: 548 Market St, PMB 90375, San Francisco, CA 94104, USA
- Transfer safeguard
- EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Anthropic is not certified under the EU-U.S. Data Privacy Framework.
How we tell you about changes
We tell every customer by email at least 30 days before we add or replace a sub-processor, and update this page; customers may object, as our data processing agreement describes. When a sub-processor tells us, with less notice, that it is changing its own sub-processors, we pass that on as soon as we receive it.
Not a sub-processor: your own shop
If you connect your Shopify store, Corresso reads from it on your instruction, through your own account with Shopify. Shopify is your provider, under your agreement with it — not ours — so it is not on this list. Pictures of the products in an order load in your staff’s browsers straight from Shopify’s servers (cdn.shopify.com); our privacy notice tells them what Shopify receives.