Sub-processor list
Last updated: 28 September 2026
These are the third parties that process personal data on your behalf as part of the Klai service. All operate under contracts that comply with our DPA and GDPR, except where noted otherwise.
For a full list of every tool and service we run, including self-hosted software, see Tools we use.
| Sub-processor | What they do | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts all Klai infrastructure. Your data resides on their servers in Finland and Germany. | Finland, Germany (EU) |
| Mistral AI SAS | Handles AI inference for queries that require models we do not run locally. Query content is not retained. | France (EU) |
| Moneybird B.V. | Handles billing, subscriptions, and invoicing. Processes SEPA direct debit via Moneybird Payments. | Netherlands (EU) |
| Cloud86 | SMTP relay for transactional emails sent by Klai. Processes recipient email addresses and first names in transit. DPA signed. | Netherlands (EU) |
Hetzner detail
DPA accepted: 7 March 2026 Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Hetzner’s own data centers in Finland and Germany. No external cloud providers are involved. Retention: Deleted upon contract termination Hetzner’s sub-processors: hetzner.com/AV/subunternehmer.pdf
As infrastructure provider, Hetzner hosts the servers on which all Klai data resides. They act as a passive infrastructure layer and do not actively access or process the data stored on those servers.
Data categories on Klai’s Hetzner infrastructure:
| Category | Notes |
|---|---|
| Account data | Name, email address, company name |
| Usage data | Feature usage and session metadata |
| Query data | AI query content, only when session logging is enabled |
Mistral detail
DPA accepted: 5 March 2026 Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: France (EU), Mistral’s own infrastructure Retention: Not retained after inference is complete Training: Query data is not used to train AI models. Mistral’s paid plan is opted out of training by default. Mistral’s sub-processors: trust.mistral.ai/subprocessors
Mistral only receives the content of each API call. They have no access to account data, user identities, or billing information. Klai never includes this data in API requests.
Data categories sent to Mistral per API call:
| Category | Notes |
|---|---|
| Query content | The text of the AI inference request |
| Uploaded documents | Content of any files included in a query |
Account details, user identities, and billing information are never included in API calls to Mistral.
Moneybird detail
DPA signed: 7 March 2026 (version 1.2) Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Amazon Web Services (Germany) and Google Cloud (Netherlands), within the European Economic Area Retention: Deleted upon contract termination, except where fiscal retention obligations apply (7 years, Article 52 AWR) Moneybird’s sub-processors: moneybird.nl/partners
Data categories processed:
| Category | Example |
|---|---|
| Company name | Klai B.V. i.o. |
| First and last name | Contact person |
| Attention (t.a.v.) | Department or role |
| Address, postcode, city, country | Billing address |
| Invoice email address | billing@example.com |
| Quote email address | quotes@example.com |
| Chamber of Commerce number (KvK) | 12345678 |
| VAT identification number | NL123456789B01 |
| Sales tax number (omzetbelastingnummer) | Same as VAT number in most cases |
| Phone number | Contact number |
| Customer number | Internal Moneybird reference |
| Bank account number (IBAN) | For SEPA direct debit |
Cloud86 detail
DPA: Signed. Legal basis: Performance of contract (Article 6(1)(b) GDPR) Storage: Netherlands (EU). Cloud86 servers are located in the Netherlands. Retention: Email addresses are processed in transit only; not stored by Cloud86 beyond standard mail relay logs.
Cloud86 acts as SMTP relay for transactional emails sent by Klai (invitations, password resets, email verification). The email content is generated by Zitadel and passed through Cloud86 in transit. Cloud86 processes the recipient email address and the email body, which includes a personalised greeting with the recipient’s first name.
Data categories processed:
| Category | Notes |
|---|---|
| Recipient email address | Email address of the recipient, processed in transit |
| Recipient first name | Included in the email greeting (e.g. “Hi Mark,”), processed in transit |
Changes
Customers under a signed DPA will be notified by email at least 14 days before a new sub-processor is added. Removals do not trigger a notification.
Contact
Questions about a sub-processor, our DPA, or a customer notification go to our legal contact.
Steven Buurma
Klai B.V. i.o.
Lubeckweg 2
9723HE Groningen
The Netherlands
E-mail: rights@getklai.com