A sub-processor is any vendor that processes personal data on Sprecho's behalf. The list below is the same one that appears as Annex B of the data processing agreement, and it is published because Art. 28(2)(b) GDPR requires you to be able to see it.
Annex B of the data processing agreement is the binding version; the Trust Center and this page mirror it.
Who processes data on Sprecho's behalf?
| Vendor | Role | Region |
|---|---|---|
| STRATO GmbH | Production hosting — application servers, PostgreSQL database, object storage, email infrastructure, control plane | Germany |
| Media Trooper GmbH (Trooper.ai) | GPU compute for transient speech recognition and LLM inference. No persistent customer data is stored at this layer | Germany and the Netherlands |
| Hetzner Online GmbH | Off-site database backups (daily, object storage, TLS-encrypted transfer). Not on the request path; since 09/2025 | Germany (Nuremberg) |
| Mollie B.V. | Payment processing for EU customers (iDEAL, SEPA, credit card) | Netherlands |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing for customers worldwide who pay by PayPal | Luxembourg |
| Brevo (Sendinblue) | Transactional email — sign-in links, receipts, security notices | France |
| Haufe-Lexware GmbH & Co. KG (LexOffice) | Invoice generation and bookkeeping records required by German tax law (§ 147 AO) | Germany |
Every one of them is established in the EU/EEA. There is no transfer of customer data to a third country, which is why no transfer impact assessment is needed.
Which of them see my dictations?
Only two, and only in the ways described here.
STRATO GmbH hosts the servers on which audio files and transcripts are stored. The data sits on encrypted storage in German data centres; STRATO operates the infrastructure and does not access the content.
Media Trooper GmbH provides the GPUs that run speech recognition and the formatting model. Audio and text pass through for the seconds the processing takes and are not persisted there.
Hetzner Online GmbH receives only backup copies of the database — daily, in object storage in Nuremberg. It is not on the request path; the transfer is TLS-encrypted.
The other four never see dictation content. A payment provider sees a billing amount and an identifier; the email provider sees your address and name; the invoicing provider sees invoice line items.
Sprecho does not use a third-party AI service. Speech recognition and formatting run on models Sprecho operates on the GPUs above — audio, transcripts and account data are not sent to OpenAI, Anthropic, Google, Microsoft or any comparable provider, and are never used to train a model.
How changes are announced
Material changes to this list — adding a sub-processor, or moving a role between them — are communicated in writing with at least 30 days' notice, so that customers can object or terminate before the change takes effect. That is a commitment written into the data processing agreement, not just a practice.
The list has changed before. Annex B of the data processing agreement is the binding version; the Trust Center and this page mirror it — so do not rely on a copy in a questionnaire from last quarter.
Website analytics is a separate question
The sub-processor list above is about the product. The sprecho.ai website additionally uses Google Analytics and the Meta Pixel, and only after you accept them in the cookie banner. Both are consent-based, both can be withdrawn at any time in the cookie settings, and neither receives dictation content.
The desktop and mobile apps contain no analytics or tracking SDK at all.
Getting this in writing
Procurement reviewers usually need the signed version rather than a help article. Request access to the Trust Center with your work email and you get the DPA including Annex B, the sub-processor list, the SLA and the sector addenda. The route is described in GDPR and your data processing agreement.
For anything the Trust Center does not answer, write to dpo@sprecho.ai.