Sub-processor list.
Complete list of all sub-processors we use in providing our services, with location, function, contract status and scope of data access. Compliant with GDPR Art. 28. Machine-readable at /.well-known/sub-processors.json.
Current status and scope
This list covers every processor dynexo uses to deliver what it is contracted for. It is kept current, and changes are communicated in writing to all active customers. A machine-readable version is available at /.well-known/sub-processors.json and can be imported into compliance tooling.
For financial customers under DORA: the register of information under DORA Art. 28 is held separately and handed over per customer.
Where to get the full details
The short list on this page is the publicly available version. The detailed contract terms, audit scopes per sub-processor and risk scoring are provided under NDA. We set up an NDA process within 48 hours. For active customers the full list is part of the data processing agreement.
Categories
We distinguish three categories of sub-processor:
- Infrastructure (hosting, data center, network services)
- Operations tools (monitoring, logging, ticketing, communication)
- Model providers (LLM and AI model providers for customers who use these models; BYO key is the default)
All EU sub-processors are directly subject to GDPR. For sub-processors outside the EU we use EU standard contractual clauses and carry out transfer impact assessments. US sub-processors are only used when (a) the customer explicitly consents and (b) no personal or sensitive data is transferred.
Who we use
| Provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Servers for the website and services Infrastructure |
DE |
As of: 2026-10-01
Models that run on our own infrastructure are not listed here: no third party is involved and no data leaves the building. Tools we use for our own work, rather than to deliver a service, are not in this list either.
What is often asked before a contract is signed
14 days before taking effect, to all active customers, in writing and with a reason. Where a sub-processor change alters the risk class, the notice period is 30 days.
Yes, through the data processing agreement. Default: a 14-day objection period after notice. If the sub-processor is essential and the objection cannot be resolved, special termination of the customer agreement is possible.
Only when dynexo provides the model access. With BYO key (the default), data goes directly from the customer to the provider. We are not a sub-processor in that chain.
The public list is an overview. The register of information under DORA Art. 28 is a separate document with risk scoring, substitutability analysis and ICT concentration risk assessment. It is provided to financial customers under NDA.
Full sub-processor list under NDA.
NDA process within 48 hours. For financial customers, the register of information under DORA Art. 28 is also available. Machine-readable JSON version is public.