Authorized Sub-processors
An up-to-date list of the service providers (sub-processors) engaged by snowLEX Oy to deliver the snowLEX service, in accordance with our Privacy Policy and Data Processing Agreement. No AI or LLM provider appears on this list: AI inference runs on models we host ourselves, on European infrastructure.
Last updated: 2026-09-16
| Sub-processor | Purpose | Data Location | DPA / Safeguards |
|---|---|---|---|
| UpCloud Oy | Cloud infrastructure, hosting, database, encrypted document storage, and AI inference | EU (Finland) | UpCloud DPA (Finnish company) |
| Hetzner Online GmbH | Infrastructure running the vector database used for semantic search and document retrieval | EU (Germany) | Hetzner DPA (German company) |
| Stripe Payments Europe, Ltd. | Payment processing and subscription management (billing data only, never legal content) | EU (Ireland) / US | Stripe DPA, SCCs |
| Resend | Transactional email delivery (password resets, invitations, invoices); email address and name only | US | Resend DPA, SCCs |
Sovereign, Self-hosted AI
All AI inference runs on models snowLEX hosts itself, on dedicated infrastructure in the European Union operated by European companies: UpCloud Oy in Finland and Hetzner Online GmbH in Germany. No third-party or non-EU AI provider is involved: your queries and documents never leave our controlled environment, are not retained beyond your session unless you save them, and are never used to train any model.
International Data Transfers
All hosting, storage and processing of your legal content takes place within the European Union, on infrastructure operated by European companies: UpCloud Oy in Finland for the application, database, document storage and AI inference, and Hetzner Online GmbH in Germany for the vector database used for retrieval. Your prompts, documents and outputs are never transferred outside the EU. The only data that may be processed by a provider outside the EU is limited administrative data needed to run the Service (payment details handled by Stripe and the email address used for transactional email), always under GDPR Chapter V safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an Adequacy Decision.
No Data Sales
We strictly do not sell, rent, monetize, or trade your personal data. Data is only shared with carefully vetted sub-processors strictly necessary for operating our infrastructure.
Changes to This List
We will update this page when sub-processors are added or removed. Material changes will be communicated via email to active users in accordance with our DPA obligations.
Questions about our data processing?
If you have questions about our sub-processors or data processing practices, please reach out to our Data Protection Officer.
Contact DPO