Subprocessors.
The current list of subprocessors (Art. 28(2) and (4) GDPR) engaged by Life is a pitch UG (haftungsbeschränkt) for the Koios Company OS. The data processing agreement refers to this page; the version in force at signature is reproduced in each signed agreement and remains authoritative for that client.
As of: 4 November 2026
Platform & hosting
Vercel Inc.
Role: Hosting of the client platform
Region / safeguards: USA/EU — standard contractual clauses
Supabase Pte. Ltd.
Role: Database and platform hosting
Region / safeguards: EU region Ireland (eu-west-1); support access by Supabase, Inc., USA — standard contractual clauses
DigitalOcean LLC
Role: Server hosting of the automation environment including the knowledge-system connector; S3-compatible object storage ("Spaces") for the raw archive, large attachments and encrypted backups
Region / safeguards: Frankfurt, Germany (EU)
Versioned storage
GitHub Inc.
Role: Versioned storage of the knowledge systems
Region / safeguards: USA — standard contractual clauses
AI processing — text & automation
Anthropic Ireland, Limited
Role: AI processing of the automated runs (variant A: accounts of the processor)
Region / safeguards: Ireland; processing in the USA by the parent Anthropic, PBC — standard contractual clauses
OpenAI Ireland Ltd.
Role: Text embeddings for indexing and searching the knowledge system
Region / safeguards: Ireland; processing in the USA by OpenAI OpCo, LLC — standard contractual clauses
AI image and media generation (only with the respective module)
OpenAI Ireland Ltd.
Role: Image generation
Region / safeguards: Ireland; processing in the USA by OpenAI OpCo, LLC — standard contractual clauses
Eleven Labs Inc.
Role: Voice-over and music for videos of the Studio module
Region / safeguards: USA — standard contractual clauses
Communication & delivery
Mailgun Technologies, Inc.
Role: Receipt of e-mails addressed to the client's knowledge-system address and forwarding to the intake queue; sending of digests and notifications — processed in the provider's EU region (Frankfurt)
Region / safeguards: USA/EU — standard contractual clauses
Discord Inc.
Role: Internal operations alerts of the processor, without knowledge-system content
Region / safeguards: USA — standard contractual clauses
Module-bound services (only with the respective module)
Gitroom Limited / Gitroom LLC („Postiz“)
Role: Social media scheduling and publishing
Region / safeguards: Hong Kong/USA — data processing addendum with standard contractual clauses
Apify Technologies s.r.o.
Role: Market and topic monitoring, capture of public website content, reach and interaction metrics of commissioned social media channels
Region / safeguards: EU
Hetzner Online GmbH
Role: Render servers of the Studio module for image and video production, running only for the duration of a render job
Region / safeguards: Falkenstein, Germany (EU)
Meta Platforms Ireland Ltd.
Role: WhatsApp Business Platform for the WhatsApp support channel, via an application of the processor
Region / safeguards: Ireland/USA — standard contractual clauses
TypeSafe AI, Inc.
Role: Pre-classification of support inquiries (urgency, topic, language, abuse risk); receives redacted inquiry text only — redaction remains a technical and organisational measure
Region / safeguards: USA — standard contractual clauses
Not subprocessors
Services the client operates or licenses itself and that we only read with the client’s credentials (CRM, task tool, cloud storage, mailbox, bank interface).
Accounts the client provides for data storage under DPA § 8.4 (own database and storage project, own version-control organisation): these providers are the client’s processors.
AI providers used under the client’s own account (DPA § 8.2) and the Meeting Assistant, which transcribes locally on the client’s device.
TypeSafe (typesafe.ai) in the support module: it receives only redacted request texts without personal data.
Atlas Cloud (atlascloud.ai) in the Studio module: for video generation it receives only text prompts and image references without personal data.
Changes
Additions and replacements are announced in text form to the contract contact of each client, with a 14-day right to object (DPA § 7.2). Switching models within an approved AI provider is not a change of subprocessor.
Questions
Questions about this list: hey@lifeisapitch.io