Last updated: 13 August 2026
Quaterio is operated by Triple Down AB, org. nr 559333-6091, VAT SE559333609101, Skeppargatan 55, 114 59 Stockholm, Sweden. To run the Service we use the providers below. Each one is a sub-processor under Article 28 GDPR, and each is engaged under a data processing agreement. Every provider's agreement is linked under its name, so you can read the terms we are held to rather than take our word for it.
The point of this page is the middle column. A list of company names tells you nothing useful, so we say what actually reaches each provider.
| Provider | What it receives | Purpose | Location |
|---|---|---|---|
| SupabaseTheir DPA | Account details, organization data, documents and generated PDFs | Database, authentication and file storage | EU (Frankfurt) |
| VercelTheir DPA | Request metadata, IP addresses in server logs | Application hosting and content delivery | Global edge network |
| HetznerTheir DPA | Document content sent for rendering, and files you upload for import (PDF, DOCX, PPTX) | Virtual server running our PDF rendering and document import service | EU (Germany) |
| StripeTheir DPA | Billing details and payment method. We never see card numbers | Payment processing and subscription billing | US and EU |
| ResendTheir DPA | Email address and message content of the emails we send you | Transactional email delivery | US |
| Google GeminiTheir DPA | The text of the document you are importing. Nothing is sent if you skip AI formatting, and it is skipped automatically for already structured files | AI formatting of an imported document, only when you choose to use it | US |
| OpenAITheir DPA | The text of the document you are importing, if this provider is enabled. The endpoint exists but no part of the product calls it today | Alternative AI formatting provider for document import, currently not used by the app | US |
| SentryTheir DPA | Diagnostic data about errors, which can include your user id, the URL and request context | Error and performance monitoring | US |
| Google reCAPTCHATheir DPA | IP address and interaction signals, on that form only | Bot detection on the contact form | US |
| UpstashTheir DPA | The parsed content of a document you import, held for up to 30 minutes while the job runs, then expired automatically | Job queue for asynchronous parsing of documents you import | EU (Belgium), provider incorporated in the US |
| Umami (self hosted) | Page views and, with your consent, sampled session recordings. No cookies, no cross site identifier | Cookieless analytics and sampled session replay | EU (Germany), on our own Hetzner server |
Two entries above touch the documents you create, so they are worth calling out.
Rendering. Every PDF is rendered on a server we run at Hetzner in Germany, and files you import are parsed there too, with the uploaded file held in Hetzner object storage until the parse finishes. Parsing runs as a queued job, and the queue is Upstash Redis in Belgium, which holds the parsed content for up to 30 minutes before it expires. Content is processed to produce your file and is not retained for anything else.
AI formatting. If you choose AI formatting when importing a document, that document's text goes to Google Gemini. It is optional every time, it is skipped automatically for already structured files, and nothing is sent if you skip it. Your documents are not used to train any model.
Providers marked US receive personal data outside the European Economic Area. Those transfers rely on Standard Contractual Clauses or an equivalent safeguard under Chapter V GDPR.
We update this page when a sub-processor is added or removed. Business and Enterprise customers with a signed data processing agreement can ask to be notified in advance of a new sub-processor, and to object, on the terms set out in that agreement. Email hello@quaterio.com to be added to that notification list.
