To operate aurenote we use the following carefully selected service providers. The last column states the status of the data processing agreement. Some providers do not process data on our behalf but as their own controllers, for example when you sign in with Microsoft, Apple or Google; the last column says so too. This list is updated whenever something changes - active customers are informed in advance.
Infrastructure & hosting
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Infomaniak Network SA | Hosting of the application, the PostgreSQL database and the recordings, plus the daily encrypted backup (Swiss Backup) | Switzerland (hosting in Geneva) | No cross-border transfer (processing in Switzerland) | Active |
AI processing
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Anthropic Ireland, Limited | AI processing of transcripts and notes into summaries, action items and answers in 'Ask your notes' | USA | Standard Contractual Clauses (SCC) with Swiss addendum; use via the API under Anthropic's commercial terms, under which customer data is not used for training | Active |
Audio & meeting bot
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Recall.ai (Hyperdoc Inc.) | Meeting bot that joins online meetings (Teams, Meet, Zoom, Webex), announces the recording and records the meeting. We then fetch the audio track and transcript to our servers in Switzerland and delete the recording at Recall, at the latest after 7 days. | USA (region us-east-1) | Standard Contractual Clauses (SCC) | Active |
| AssemblyAI, Inc. | Speech-to-text transcription with speaker diarization (Universal-2). Uploaded files and recordings from the browser and app go via the EU location (Dublin); this data is not used for training and is deleted after one day. Meetings with the bot reach AssemblyAI via Recall.ai. | EU (Dublin) / USA | Standard Contractual Clauses (SCC) | Active |
Communication
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Resend (Plus Five Five, Inc.) | Delivery of the service's emails (credentials, confirmations, password reset, invitations, the notice that a summary is ready with an excerpt from it, and summaries you send) | USA (East) / EU available | Standard Contractual Clauses (SCC) | Active |
App push notifications (optional)
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications to the app (iOS and Android). A notification contains a short message, counts, times, the text of due tasks, titles of meetings, notes and appointments and the name of whoever shared something with you, but never the transcript or the summary. | USA | Standard Contractual Clauses (SCC) with Swiss supplementary terms under the Firebase data processing terms; only if you allow notifications in the app | Active |
| Apple Inc. (Apple Push Notification service) | Delivery of push notifications on iPhones: Firebase hands the notification to Apple | USA | Apple Developer Program License Agreement; only on iPhones with notifications allowed | No DPA offered (developer agreement applies) |
Sign-in & calendar (optional)
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Microsoft Ireland Operations Limited | Sign-in with a Microsoft work account (OAuth) and Microsoft Graph API for the optional Outlook/Teams calendar connection (reading; on request also adding events) | Ireland / global | Microsoft processes this data as its own controller under its privacy statement; only if you sign in with Microsoft or connect your calendar | Own controller (no DPA needed) |
| Google Ireland Limited | Sign-in with Google (on request) and OAuth sign-in and Google Calendar API (reading; on request also adding events) for the optional calendar connection | Ireland / USA | Google processes this data as its own controller (Google Controller-Controller Data Protection Terms, with Standard Contractual Clauses and Swiss supplementary terms); only if you sign in with Google or connect your calendar | Own controller (no DPA needed) |
| Apple Distribution International Ltd. (Sign in with Apple) | Sign-in with your Apple ID; when you delete your account we revoke the connection at Apple | Ireland | Apple processes this data as its own controller under its privacy policy; only if you sign in with Apple | Own controller (no DPA needed) |
Payment processing
| Provider | Purpose | Location | Transfer basis | DPA status |
|---|
| Stripe Payments Europe Ltd. | Payment processing (credit card and other payment methods), subscription management and invoices for purchases via the checkout on aurenote.ch. For fraud prevention and anti-money-laundering checks, Stripe is its own controller. | Ireland / Switzerland | EU/CH (PCI-DSS Level 1 certified); Stripe Data Transfers Addendum with Standard Contractual Clauses and Swiss terms | Active |
| Apple Distribution International Ltd. (App Store) | Subscriptions and hour packages you buy in the iPhone app: Apple processes the payment and notifies us of purchases, renewals, cancellations and refunds | Ireland | Apple processes this data as its own controller under its privacy policy; only for purchases in the iPhone app | Own controller (no DPA needed) |
Changes
When sub-processors are changed, added or removed we inform all customers at least 30 days in advance by email. If you legitimately object, you have the right to terminate the contract extraordinarily.
aurenote