Annex 3 to the data processing agreement. Version 3.2, 30 October 2026. We announce changes 30 days in advance (DPA section 5.2).
"Customer data" says whether the provider may process personal data that we process on behalf of a customer. Providers marked "no" serve only our own business (see the privacy policy). Where a customer's non-disclosure agreement restricts which tools we may use, we use only the tools approved there.
Safeguard for transfers outside the EEA: "DPF" is the EU-U.S. Data Privacy Framework (Art. 45 GDPR) for certified providers; "SCC" are the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the provider's data processing terms.
Infrastructure
Provider
Purpose
Location
Safeguard
Customer data
netcup GmbH, Karlsruhe, Germany
Server hosting: website, API, meeting transcription and speaker separation, encrypted backups
Germany
EU
Yes
Supabase, Inc., USA
Database of the 24/6 workspace and our customer records
EU (AWS eu-north-1, Stockholm); support access from the USA
DPF or SCC
Yes
Scaleway SAS, Paris, France
Rented GPU server for open-source AI models, created on demand and deleted after use
France
EU
Yes
GitHub, Inc., USA
Source code repository and version history
USA
DPF or SCC
No
AI models
Provider
Purpose
Location
Safeguard
Customer data
Anthropic Ireland, Limited, with Anthropic, PBC, USA
Claude models: summaries, analysis, drafting. Use for model training switched off
USA
SCC
Only where the customer has approved it
Google Ireland Limited
Gemini within Google Workspace
EU and USA
DPF or SCC
Only where the customer has approved it
Communication
Provider
Purpose
Location
Safeguard
Customer data
Google Ireland Limited
Google Workspace: email, calendar, Meet video calls, documents
EU and USA
DPF or SCC
Yes
Resend, Inc., USA
Transactional email, including meeting notifications to our own mailbox (time, length, participant names; never the transcript)
USA
DPF or SCC
Yes
Mailgun Technologies, Inc. (Sinch), USA
Receiving and routing email sent to m246.org addresses
USA
DPF or SCC
Yes
Microsoft Ireland Operations Limited
Azure: email automation
EU and USA
DPF or SCC
No
Slack Technologies, LLC, USA
Messaging with customers who use Slack
USA
DPF or SCC
Yes, in shared channels
WhatsApp Ireland Limited
Messaging
EU and USA
DPF or SCC
No
Cal.com, Inc., USA
Booking of calls
USA
SCC
No
Business tools
Provider
Purpose
Location
Safeguard
Customer data
Notion Labs, Inc., USA
Internal notes and documentation
USA
DPF or SCC
No
Granola, Inc., USA
Meeting notes in calls we hold ourselves, with participants' consent
USA
SCC
No
Stripe Payments Europe, Limited, Ireland
Payments and billing
EU and USA
DPF or SCC
No
Trustpilot A/S, Copenhagen, Denmark
Review invitations to customers
EU
EU
No
Processed on our own devices, no provider involved
Meeting transcription with open-source speech recognition on our server and on our encrypted work laptop; open-source AI models run locally (LM Studio); code editing (VS Code).