Sub-processor list
Last updated: 22 March 2026
These are the third parties that process personal data on your behalf as part of the Klai service. All operate under contracts that comply with our DPA and GDPR, except where noted otherwise.
For a full list of every tool and service we run, including self-hosted software, see Tools we use.
| Sub-processor | What they do | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts all Klai infrastructure. Your data resides on their servers in Finland. | Finland (EU) |
| Mistral AI SAS | Handles AI inference for queries that require models we do not run locally. Query content is not retained. | France (EU) |
| Moneybird B.V. | Handles billing, subscriptions, and invoicing. Processes SEPA direct debit via Moneybird Payments. | Netherlands (EU) |
| Cloud86 | SMTP relay for invitation emails sent by Klai. Processes recipient email addresses in transit. DPA not yet signed. | Netherlands (EU) |
Hetzner detail
DPA accepted: 7 March 2026 Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Hetzner’s own data center in Helsinki, Finland. No external cloud providers are involved. Retention: Deleted upon contract termination Hetzner’s sub-processors: hetzner.com/AV/subunternehmer.pdf
As infrastructure provider, Hetzner hosts the servers on which all Klai data resides. They act as a passive infrastructure layer and do not actively access or process the data stored on those servers.
Data categories on Klai’s Hetzner infrastructure:
| Category | Notes |
|---|---|
| Account data | Name, email address, company name |
| Usage data | Feature usage and session metadata |
| Query data | AI query content, only when session logging is enabled |
Mistral detail
DPA accepted: 5 March 2026 Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: France (EU), Mistral’s own infrastructure Retention: Not retained after inference is complete Training: Query data is not used to train AI models. Mistral’s paid plan is opted out of training by default. Mistral’s sub-processors: trust.mistral.ai/subprocessors
Mistral only receives the content of each API call. They have no access to account data, user identities, or billing information. Klai never includes this data in API requests.
Data categories sent to Mistral per API call:
| Category | Notes |
|---|---|
| Query content | The text of the AI inference request |
| Uploaded documents | Content of any files included in a query |
Account details, user identities, and billing information are never included in API calls to Mistral.
Moneybird detail
DPA signed: 7 March 2026 (version 1.2) Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Amazon Web Services (Germany) and Google Cloud (Netherlands), within the European Economic Area Retention: Deleted upon contract termination, except where fiscal retention obligations apply (7 years, Article 52 AWR) Moneybird’s sub-processors: moneybird.nl/partners
Data categories processed:
| Category | Example |
|---|---|
| Company name | Klai B.V. |
| First and last name | Contact person |
| Attention (t.a.v.) | Department or role |
| Address, postcode, city, country | Billing address |
| Invoice email address | billing@example.com |
| Quote email address | quotes@example.com |
| Chamber of Commerce number (KvK) | 12345678 |
| VAT identification number | NL123456789B01 |
| Sales tax number (omzetbelastingnummer) | Same as VAT number in most cases |
| Phone number | Contact number |
| Customer number | Internal Moneybird reference |
| Bank account number (IBAN) | For SEPA direct debit |
Cloud86 detail
DPA: Not yet signed. In progress. Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Netherlands (EU). Cloud86 servers are located in the Netherlands. Retention: Email addresses are processed in transit only; not stored by Cloud86 beyond standard mail relay logs.
Cloud86 acts as SMTP relay for invitation emails sent by Klai. When a user is invited to Klai, the invitation email is delivered via Cloud86’s mail infrastructure. Cloud86 processes only the recipient email address in transit to deliver the message.
Data categories processed:
| Category | Notes |
|---|---|
| Recipient email address | Email address of the invited user, processed in transit |
Changes
Customers under a signed DPA will be notified by email at least 14 days before a new sub-processor is added. Removals do not trigger a notification.
This document is published under CC BY 4.0. You are free to adapt it for your own organisation. Credit: Klai B.V.