Sub-processor List
What changed since the version of June 23, 2026
Drei Unterauftragsverarbeiter sind hinzugekommen. Microsoft Corporation (Azure Container Apps) für das Anwendungshosting, Verarbeitung in der EU (West Europe, Niederlande). European Search Perspective (Staan), Frankreich, Verarbeitung in der EU (OVHcloud), für die Websuche des KI-Assistenten im Szenario-Editor; übermittelt werden ausschließlich KI-generierte Suchanfragen aus dem Editorgespräch, höchstens 400 Zeichen, sowie ein Sprachraum-Parameter. Mistral AI SAS, Frankreich, Verarbeitung in Frankreich, für Texterkennung hochgeladener Dokumente, Einbettungen und KI-Auswertung.
Zum Anwendungshosting eine Richtigstellung: Die Fassung vom 23. Juni 2026 nannte Clever Cloud SAS als Anwendungshoster. Tatsächlich lief die Plattform zu diesem Zeitpunkt auf Microsoft Azure Container Apps. Beide Anbieter sind jetzt gelistet; versa kann die Plattform bei einem der beiden betreiben. Beide verarbeiten ausschließlich in der EU, eine internationale Übermittlung findet dabei nicht statt.
Der Ausschluss der Nutzung von Kundendaten für Trainingszwecke der Anbieter ist jetzt einmal für alle Anbieter beschrieben statt je Kategorie. versa vereinbart ihn vorrangig vertraglich und setzt ihn andernfalls über die Kontoeinstellungen des Anbieters um. Ist er auf keinem dieser Wege erreichbar, wird das beim betreffenden Anbieter in dieser Liste ausgewiesen.
Der Firmenname ist auf die registrierte Schreibweise "versa Training GmbH" korrigiert.
Important: The German version of this document is legally binding under Austrian law, irrespective of the reader's jurisdiction (versa Training GmbH is an Austrian company). This English version is an informational translation provided for convenience only. EU consumer protections of your country of residence apply regardless of this binding-language clause (Rome I Regulation, Art. 6(2)). In case of conflict between the German and English texts, the German text governs.
This document lists the sub-processors used by versa Training GmbH to deliver the versa Platform. Sub-processors process data solely on the basis of our documented instructions, under appropriate data processing agreements.
This page is the authoritative sub-processor list referenced in Annex 3 of the Data Processing Agreement (DPA).
Changes to this list are notified to customers at least 7 days in advance in accordance with Section 9.2 of the Data Processing Agreement (DPA).
Note on data use: Use of Customer data for the providers' own training purposes is excluded. versa agrees this exclusion contractually wherever possible and otherwise implements it through the account settings the provider makes available. Where it is achievable by neither route, that is disclosed against the provider concerned in this list (DPA Section 9.4).
Infrastructure and Platform
| Sub-processor | Entity jurisdiction | Processing location | Purpose | Data processed | Transfer mechanism |
|---|---|---|---|---|---|
| Supabase Inc. | USA / Singapore (data importer under SCCs) | EU (AWS Frankfurt) | Database, authentication, file storage | All Customer data | EU processing; Standard Contractual Clauses (Modules 2 & 3) |
| Clever Cloud SAS | France | EU (France, Paris region) | Application hosting (compute/container runtime of the versa Platform) | All Customer data (processed during application operation) | EU processing (no international transfer) |
| Microsoft Corporation (Azure Container Apps) | USA | EU (West Europe, Netherlands) | Application hosting (compute/container runtime of the versa Platform) | All Customer data (processed during application operation) | DPF-certified (adequacy decision); EU processing |
| Upstash, Inc. | USA | EU (configurable) | Rate limiting (Redis) | IP addresses, request metadata | DPF-certified (adequacy decision) |
| Daily.co, Inc. (Pipecat Cloud) | USA | EU ("eu" region) | WebRTC transport for real-time audio (session room, audio routing) | Audio streams in transit, session metadata | DPF-certified (adequacy decision); EU processing |
| Infomaniak Network SA | Switzerland | Switzerland | E-mail hosting and delivery (SMTP) | E-mail addresses, notification content | Swiss adequacy decision |
| PostHog, Inc. | USA | EU (AWS Frankfurt, eu-central-1) | Product analytics (pseudonymous usage events) | Pseudonymous usage events: internal user ID, feature-usage events, technical metadata — no conversation content, no names or e-mail addresses | DPF-certified (adequacy decision); EU processing |
| Bugsink B.V. | Netherlands | EU (Netherlands) | Error and event tracking (application diagnostics) | Error diagnostics: stack traces, error messages, request path and technical metadata, client IP on browser-side events — no deliberately collected names, e-mail addresses, or conversation content | EU processing (no international transfer) |
Application hosting: versa may operate the Platform with either of the two listed application hosts. Both process exclusively within the EU.
AI Reasoning Providers
These providers process text data (prompts, transcripts) for AI assessment, scenario creation, and coaching feedback. No audio data are transmitted to these services — input and output are exclusively in text form.
| Sub-processor | Entity jurisdiction | Processing location | Purpose | Data processed | Transfer mechanism |
|---|---|---|---|---|---|
| Google LLC (Vertex AI) | USA | EU | AI assessment, scenario creation | Text inputs, transcripts (text in / text out) | DPF-certified (adequacy decision); EU processing |
| Microsoft Corporation (Azure) | USA | EU (Sweden Central) | AI assessment, scenario creation | Text inputs, transcripts (text in / text out) | DPF-certified (adequacy decision); EU processing |
| Jina AI GmbH | Germany | EU (Germany) | Web content extraction (scenario editor) | URLs, extracted web content | EU processing (no international transfer) |
| European Search Perspective (Staan) | France | EU (OVHcloud) | Web search for the scenario editor AI assistant | AI-generated search queries (derived from the editor conversation, max 400 chars), market locale parameter | EU processing (no international transfer) |
| Mistral AI SAS | France | EU (France) | Text recognition (OCR) of uploaded documents, embeddings, AI assessment | Content of uploaded documents, text inputs, transcripts (text in / text out) | EU processing (no international transfer) |
AI Real-Time Conversation Providers
The versa Platform enables organisations and users to select the AI real-time conversation provider to be used for each training session. The choice of provider determines which sub-processor receives audio and conversation data for that session.
The provider's jurisdiction and the transfer mechanism are displayed in the platform interface. Organisations configure provider availability in accordance with their own data protection requirements.
All providers process data within the EU.
| Sub-processor | Entity jurisdiction | Processing location | Purpose | Data processed | Transfer mechanism |
|---|---|---|---|---|---|
| Daily.co, Inc. (Pipecat Cloud) | USA | EU ("eu" region) | Orchestration of AI real-time conversations (agent runtime, mediation between audio and the selected AI model) | Audio streams, system instructions, scenario configuration | DPF-certified (adequacy decision); EU processing |
| Microsoft Corporation (Azure) | USA | EU (Sweden Central) | AI real-time conversation | Audio streams, transcripts | DPF-certified (adequacy decision); EU processing |
| Google LLC (Vertex AI / Gemini) | USA | EU (Europe West) | AI real-time conversation | Audio streams, transcripts | DPF-certified (adequacy decision); EU processing |
Explanation of Transfer Mechanisms
- DPF-certified (adequacy decision): The sub-processor is certified under the EU-US Data Privacy Framework. The European Commission has determined that it provides an adequate level of protection (Implementing Decision 2023/1795). No additional safeguards are required.
- Standard Contractual Clauses: Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914. Used for sub-processors that are not certified under the DPF. versa conducts Transfer Impact Assessments (TIAs) for these transfers.
- EU processing: Data are processed within the European Economic Area. No international data transfer takes place.
- Swiss adequacy: Switzerland has received an adequacy decision from the European Commission.
Sub-sub-processors
Information about the sub-sub-processors of our sub-processors can be found here:
- Microsoft Azure: Microsoft Data Processing Addendum
- Supabase: Supabase Data Processing Addendum
- PostHog: PostHog Data Processing Addendum — sub-processors: posthog.com/subprocessors
- Google Cloud: Google Cloud Data Processing Addendum
- Daily.co (Pipecat Cloud): Daily.co Data Processing Addendum
- Clever Cloud: Clever Cloud Data Processing Agreement
- Bugsink: Bugsink Data Processing Agreement — sub-processor: Hetzner (EU hosting)
- Mistral AI: Mistral AI Data Processing Agreement — sub-processors: mistral.ai/terms
Questions? Contact us at privacy@versa.training