Sub-processors. Who handles data for us.

01About this pageLink copied

This page lists the sub-processors of Reqursor Technologies ("we", "us") for Reqursor. A sub-processor is a provider that we engage to process customer personal data for you. Our Data Processing Agreement refers to this page.

Reqursor Development and Reqursor Platform are now one product, Reqursor. Some of our other documents and our earlier websites still use the earlier names. On this page, Reqursor Development means the part of Reqursor that works on your code, and Reqursor Platform means the part that changes online stores, which is in early access, by invitation.

Which providers apply to you depends on how you use Reqursor:

• We host Reqursor for you, or your license runs on Reqursor Credits. Your instance is stored with our hosting provider, your model requests pass through our relay to Anthropic, and the providers in section 2 process them and the data in your instance.
• You install Reqursor on your own server with your own key. Reqursor runs on your server and your model requests go straight to your own provider, so the providers in section 2 that handle model requests do not receive them. The one exception is Reqursor Intelligence, the assistant panel: if an Owner or Admin of a self-hosted installation chooses our monthly allowance for it, the assistant's questions go through our relay to Anthropic, and Anthropic processes them.
• We run online stores for you, in early access. The providers marked for online stores in section 2 process the data of that part. Your stores' business data, such as products and orders, stays in each store's own isolated storage, and our Data Processing Agreement explains when we read it.

02Sub-processors for customer personal dataLink copied

These providers process the content of your model requests when your license runs on Reqursor Credits, the assistant's questions when an Owner or Admin of a self-hosted installation chooses our monthly allowance, the data in an instance that we host for you, the settings that the AI chat of an online store sends, the data of online stores that we run for you, and the support material that you send us.

Anthropic

• What it does: provides the AI models behind Reqursor Credits, behind the assistant when we pay for it from our monthly allowance and behind the AI chat of online stores. For Reqursor Credits and the assistant, our relay forwards each model request to Anthropic with our own account, and Anthropic returns the answer. For online stores, our system sends the request to Anthropic through the Claude API.
• Data: for Reqursor Credits, the content of your model requests, which can hold your code, ticket text and any personal data in them, and the answers. For the assistant, the question and the ticket, run, plan, finding and project details it read to answer. For online stores, the messages you type in the chat and the store settings needed for the task, limited to one organization per request, and never secret values, store business data or customer information. Anthropic may keep requests and answers for a limited time under its terms.
• Entity: Anthropic Ireland, Limited, Ireland, which contracts with customers in the European Economic Area, Switzerland and the United Kingdom.
• Where: Anthropic decides where it processes data under its commercial terms. This can include places outside the European Economic Area. The safeguard for that transfer is the standard contractual clauses in Anthropic's data processing addendum, which its commercial terms incorporate.
• Terms: Anthropic's commercial terms with us apply. Under them, Anthropic states that it does not train its models on data from its API customers. We do not have a zero-retention agreement with Anthropic.

Hetzner Online GmbH

• Provider: Hetzner Online GmbH, Gunzenhausen, Germany.
• Our relay and license server: they run on a Hetzner server in a data center in Nuremberg, Germany. Your model requests pass through its servers in transit, and the relay's logs and usage records are stored there for a short time. The relay does not store requests or answers. The license server holds the license, billing and usage records that we keep as the controller.
• Hosted instances: an instance that we host for you runs on a Hetzner server in a data center in Falkenstein, Germany. It holds everything in your instance: your tickets, run history, audit log and encrypted secrets, and the copies of your repositories that the agent works on.
• Online stores: our Data Processing Agreement names Hetzner for the hosting of online stores in data centers in Germany (Nuremberg and Falkenstein). It holds the store settings and the store data that we manage for you, as that agreement describes.
• Backups: Hetzner also keeps the server backups of our servers, which are copies of their disks.
• Where: Under its data processing agreement with us, Hetzner processes the data only within the European Union.

Cloudflare

• What it does: provides the network in front of the instances that we host, and in front of our license server (license.reqursor.com) and our websites. The traffic to and from these web addresses passes through it. The one exception is our relay (inference.reqursor.com), which connects directly and does not pass through Cloudflare.
• Data: what is sent to the web address of your instance and what it answers, which can hold ticket text, code and any personal data in them, and the IP address of each person who uses the instance. For the license server and our websites, it is the requests and answers of the license check, the license portal and the pages, with the IP addresses of the visitors. Cloudflare decrypts this traffic on its network and encrypts it again before it reaches our server.
• Entity: Cloudflare, Inc., United States.
• Where: Cloudflare processes traffic on its network of geographically distributed data centers, which can be outside the European Economic Area. The safeguard for that transfer is the standard contractual clauses in Cloudflare's data processing addendum, and Cloudflare states that it complies with the EU-US Data Privacy Framework.

Cloudflare R2

• What it does: stores encrypted off-site backups of the database of our license server, so that we can restore it if a server is lost.
• Data: the backup files. We encrypt each one on our own server before it is sent, with a public key. The private key is not kept on any server or at Cloudflare, so Cloudflare cannot read the content. Each backup is also signed by our server, so a restore refuses a file that did not come from us. The content is the license, billing and usage records that we keep as the controller.
• Entity: Cloudflare, Inc., United States.
• Where: Cloudflare's data centers. Any transfer outside the European Economic Area is covered by the safeguard described for Cloudflare above.
• Retention: the bucket has a lock rule that prevents deletion and overwriting for a set period. We do not keep backups indefinitely.

Google

• What it does: provides Google Workspace, which we use for our email. It sends the emails of our license server and websites, such as sign-in links, license keys and notices, and it holds the mailboxes at reqursor.com that receive the messages you send us, such as [email protected].
• Data: support material that you email us, which can contain customer personal data, such as logs, attachments and the diagnostics bundles you choose to send. It also holds the feedback that people send from inside Reqursor, which we receive as an email at [email protected]. It also handles the email addresses and the text of the emails that we send to the contacts on your license.
• Entity: Google Ireland Limited, Ireland, which provides Google Workspace to customers in the European Economic Area.
• Where: Google's data centers, under its Google Workspace terms and data processing terms. Any transfer outside the European Economic Area is covered by the Standard Contractual Clauses in those terms.
• Terms: Google's Google Workspace terms with us apply, including its data processing terms.

03Other providers that handle data for usLink copied

We use these providers to run licenses, billing and our website. For license, billing and contact data we are the controller, as our Privacy Policy describes, and for that data they are not sub-processors under the Data Processing Agreement. We list them so that you can see everyone who handles your data.

The Privacy Policy says what the Ask assistant sends and what we keep.

04Providers that are yours, not oursLink copied

With a self-hosted installation and your own key, your prompts go from your server straight to your provider, and we do not receive them. The one exception is the assistant on our monthly allowance, as section 1 says. You choose that provider, and your agreement with it applies. This covers Anthropic, Amazon Bedrock, Google Vertex AI and Microsoft Foundry and, as a beta, Kimi, which runs at HostYourAI B.V. in the Netherlands (the default for a new connection) or at Moonshot AI.

It also covers Anthropic when a person signs in with their own Claude account, on a self-hosted installation or on an instance that we host where we have switched that on: the prompts of the tickets that person runs go from the installation to Anthropic under that person's own agreement with Anthropic, and Anthropic is not our sub-processor for them.

For Kimi you choose the host and use your own key and your own agreement with that host. Read section 6 of the AI Usage Policy before you use Kimi. We do not offer Kimi through Reqursor Credits, so neither HostYourAI nor Moonshot AI is our sub-processor.

The same goes for your git remote and the integrations you connect, such as your tracker, email or Slack. You choose them, and your agreement with them applies.

05Changes to this listLink copied

We tell you at least 30 days before we add or replace a sub-processor, by email to the contacts on your license or on your account, and by updating this page. The date and revision number at the top show when the list last changed. You can object to a change on reasonable data protection grounds within 30 days, by email to [email protected], as the Data Processing Agreement describes.

06ContactLink copied

For questions about our sub-processors, or to object to a change, email [email protected]. For other legal questions, email [email protected].

You can also use the contact form. Reqursor Technologies, Rotterdam, The Netherlands.