Subprocessors
Last updated: October 27, 2026
The providers for TrueDue and the conditions under which they process data. App AI for customer correspondence is switched on for an organization until its administrator switches it off in the settings; with it off, classification uses built-in rules only and drafts use templates. With it on, the built-in rules still apply first. Replies from private persons and from debtors of unconfirmed customer type are not sent to an AI model even when App AI is enabled. Website support and connected mailboxes are separate services.
These documents are available in German and English. If the language versions differ, the German version governs. Mandatory statutory rights remain unaffected.
Providers and activation conditions
| Subprocessor | Purpose | Notes |
|---|---|---|
| netcup GmbH | Server hosting of the application and its database | Company based in Karlsruhe; primary application database and server in Nuremberg, Germany. |
| Cloudflare | Connection between the website and the servers (Cloudflare Tunnel), protection against attacks | Cloudflare, Inc., United States; network connection and security functions. Processing across its global network; data processing agreement with standard contractual clauses for relevant third-country transfers. |
| Plus Five Five, Inc. (Resend) | Sending sign-in links by email | United States; system emails. Its data processing agreement includes standard contractual clauses; the sending region and other processing are distinct. |
| OpenAI | Website support according to the configured support policy | Only for separate website support through the central Neithra system when the configured support policy uses OpenAI; OpenAI does not process incoming customer correspondence or write payment reminders in the current App AI path. Replies from private persons and other debtors are not sent to an AI model this way. OpenAI Ireland Ltd./OpenAI entities. Processing covers public product questions and user-entered support text; receivables records are not automatically attached. Activation and consent follow the notice in the support dialog. Third-country processing, particularly in the United States, under the applicable data processing agreements. Details of this separate support purpose are given in the “Anthropic / OpenAI” entry. |
| Google (Gemini Developer API) | Optional interpretation of unresolved business-customer replies | Only for confidently matched business-customer replies that fixed rules leave unresolved, with the organisation’s consent and optional App AI switched on. A valid contract with verified payment, complete provider configuration and verified prices, and sufficient budget within the existing limits are required. Selected reply text is pseudonymised before transmission and processed through the paid Gemini Developer API. A model interpretation counts only with checked supporting text in the original reply; unsupported or still unresolved cases go to a person with the original and a reason. Payment reminders use tested templates rather than model-written text. Google does not use paid prompts and responses to improve its products; limited abuse-prevention and legally required logging remains possible. Processing may take place outside the EU/EEA. Replies from private persons and from debtors of unconfirmed customer type are excluded and are never sent to the model. This is separate from Google Workspace mailbox integration and website support. |
| Microsoft | Collections mailbox integration (Microsoft 365) | Only where a Microsoft 365 mailbox is connected |
| Google (Google Ireland Ltd / Google LLC) | Collections mailbox integration (Google Workspace, Gmail API) | Only where a Google Workspace mailbox is connected |
| Anthropic / OpenAI (website support) | Answering questions in the support assistant, through the provider's central support system | Public product questions and user-entered support text, through central Neithra processing; receivables records are not automatically attached. Website support uses Anthropic for answers and OpenAI as a technical fallback. AI consent covers both recipients. Without consent, the product guide answers. Third-country processing, particularly in the United States, under the applicable provider data processing agreements. Pseudonymous conversation context is stored centrally for follow-up questions and support handoffs. Cases with no activity for 30 days are removed during regular operation. Separately submitted contact emails follow their own retention periods. |
Mailboxes connected over IMAP/SMTP
Where a customer connects a mailbox of another email provider over IMAP/SMTP (for example IONOS, Strato, all-inkl or its own Exchange Server), that provider is not a subprocessor of TrueDue. It is the customer's own contractor, engaged under the customer's own agreement, and TrueDue merely accesses the mailbox on the customer's instructions with the credentials the customer provides.
Changes to this list
Additions and replacements are notified in text form at least 30 days before planned use. You may object during that period on substantiated data protection grounds. The procedure, alternatives and any termination of the affected service are governed by the Data Processing Agreement.