Sub-processors
Last changed 3 November 2026
When Corresso processes personal data for our customers, these companies help us do it. Each one we use works under a written data processing agreement with us (GDPR art. 28(4)).
Hetzner Online GmbH
Active- Purpose
- Hosting: the servers that run Corresso and hold its database
- Personal data
- Everything Corresso stores: accounts, conversations, notes, drafts, and the copies of Shopify orders a store sends Corresso
- Where
- Germany (EU)
- Address
- Industriestr. 25, 91710 Gunzenhausen, Germany
- Transfer safeguard
- None needed: the data stays in the EU
Plus Five Five, Inc. (Resend)
Active- Purpose
- Delivering Corresso's own email (confirmations, invitations, password resets, and the mention and assignment notifications staff choose) and, for organisations that choose Send through Corresso, their replies
- Personal data
- Those messages (recipient, subject and text), the recipient, subject and text of replies sent through Corresso, and whether each was delivered or bounced
- Where
- USA
- Address
- 2261 Market Street #5039, San Francisco, CA 94114, USA
- Transfer safeguard
- EU-U.S. Data Privacy Framework (Plus Five Five, Inc. is certified under it), with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Resend’s data processing agreement as the alternative
- Keeps data
- Keeps sent messages and their delivery logs for 30 days
PostHog, Inc.
Active- Purpose
- Product analytics: counting which actions your staff take in Corresso, to improve it
- Personal data
- For each action a staff member takes: its name (such as assigning a conversation), whether it went through, the time, the staff member's user id, and your organisation's id and name. Never the text of a conversation, note or draft, nor anything that identifies a customer
- Where
- Germany (EU), PostHog's EU cloud in Frankfurt; PostHog, Inc. is in the USA
- Address
- 2261 Market St., #4008, San Francisco, CA 94114, USA
- Transfer safeguard
- EU-U.S. Data Privacy Framework (PostHog, Inc. is certified under it), with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in PostHog’s data processing agreement as well
- Keeps data
- Keeps the records for one year
Anthropic Ireland, Limited, and Anthropic, PBC
Active- Purpose
- Writing draft replies for a person to review, edit and send
- Personal data
- The text of the conversation a draft is written for, and the draft it returns
- Where
- USA (Anthropic, PBC)
- Address
- Anthropic Ireland, Limited: 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic, PBC: 548 Market St, PMB 90375, San Francisco, CA 94104, USA
- Transfer safeguard
- EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Anthropic is not certified under the EU-U.S. Data Privacy Framework.
How we tell you about changes
We tell every customer by email at least 30 days before we add or replace a sub-processor, and update this page; customers may object, as our data processing agreement describes. When a sub-processor tells us, with less notice, that it is changing its own sub-processors, we pass that on as soon as we receive it.
Not sub-processors: your staff’s browsers’ push services
A person who turns on browser notifications receives them through the push service of the browser they use — Google (Firebase Cloud Messaging) for Chrome and most browsers built on it, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows. That service is chosen by the browser, not by us, and each message is encrypted for that one browser before it leaves our servers, so the push service cannot read it. A message holds only the colleague’s first name and the subject of the conversation. Nobody’s notifications go this way unless they turn them on.
Not a sub-processor: your own shop
If you connect your Shopify store, Corresso reads from it on your instruction, through your own account with Shopify. Shopify is your provider, under your agreement with it — not ours — so it is not on this list. Pictures of the products in an order load in your staff’s browsers straight from Shopify’s servers (cdn.shopify.com); our privacy notice tells them what Shopify receives.