A sub-processor is any vendor that processes personal data on Sprecho's behalf. The list below is the same one that appears as Annex B of the data processing agreement, and it is published because Art. 28(2)(b) GDPR requires you to be able to see it.
The authoritative, always-current version lives in the Trust Center. If this page and the Trust Center ever disagree, the Trust Center is right.
Who processes data on Sprecho's behalf?
| Vendor | Role | Region |
|---|---|---|
| STRATO AG | Production hosting — application servers, PostgreSQL database, object storage, email infrastructure, control plane | Germany (Falkenstein, Nuremberg, Berlin) |
| Media Trooper GmbH (Trooper.ai) | GPU compute for transient speech recognition and LLM inference. No persistent customer data is stored at this layer | Germany and the Netherlands |
| Mollie B.V. | Payment processing for EU customers (iDEAL, SEPA, credit card) | Netherlands |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing for customers worldwide who pay by PayPal | Luxembourg |
| Brevo (Sendinblue) | Transactional email — sign-in links, receipts, security notices | France |
| Haufe-Lexware GmbH & Co. KG (LexOffice) | Invoice generation and bookkeeping records required by German tax law (§ 147 AO) | Germany |
Every one of them is established in the EU/EEA. There is no transfer of customer data to a third country, which is why no transfer impact assessment is needed.
Which of them see my dictations?
Only two, and only in the ways described here.
STRATO AG hosts the servers on which audio files and transcripts are stored. The data sits on encrypted storage in German data centres; STRATO operates the infrastructure and does not access the content.
Media Trooper GmbH provides the GPUs that run speech recognition and the formatting model. Audio and text pass through for the seconds the processing takes and are not persisted there.
The other four never see dictation content. A payment provider sees a billing amount and an identifier; the email provider sees your address and name; the invoicing provider sees invoice line items.
Sprecho does not use a third-party AI service. Speech recognition and formatting run on models Sprecho operates on the GPUs above — audio, transcripts and account data are not sent to OpenAI, Anthropic, Google, Microsoft or any comparable provider, and are never used to train a model.
How changes are announced
Material changes to this list — adding a sub-processor, or moving a role between them — are communicated in writing with at least 30 days' notice, so that customers can object or terminate before the change takes effect. That is a commitment written into the data processing agreement, not just a practice.
The list has changed before, which is exactly why we ask you to treat the Trust Center as the live version rather than trusting a copy in a questionnaire from last quarter.
Website analytics is a separate question
The sub-processor list above is about the product. The sprecho.ai website additionally uses Google Analytics and the Meta Pixel, and only after you accept them in the cookie banner. Both are consent-based, both can be withdrawn at any time in the cookie settings, and neither receives dictation content.
The desktop and mobile apps contain no analytics or tracking SDK at all.
Getting this in writing
Procurement reviewers usually need the signed version rather than a help article. Request access to the Trust Center with your work email and you get the DPA including Annex B, the sub-processor list, the SLA and the sector addenda. The route is described in GDPR and your data processing agreement.
For anything the Trust Center does not answer, write to dpo@sprecho.ai.