Providers and jurisdictions
"Your data stays in the EU" is only worth something if you can check it. This page lists every company involved in running ReefOffice, what each one actually does, what data reaches it, and whose courts it answers to. It is the sub-processor list required by Article 28 of the GDPR, written to be read rather than filed.
| Provider | What it does | What data reaches it | Jurisdiction | Independent certification |
|---|---|---|---|---|
| Contabo GmbH Munich, Germany · Amtsgericht München HRB 180722 | Hosts your private server | Everything you store — at rest it is LUKS2-encrypted with a key Contabo does not hold | 🇩🇪 Germany | ISO/IEC 27001 — data centres (supplier statement) |
| Hetzner Online GmbH Gunzenhausen, Germany | Encrypted off-site backups, and the control plane that manages your server | Restic-encrypted backup archives. Hetzner sees ciphertext only | 🇩🇪 Germany | ISO/IEC 27001:2022 (ISMS, all hosting services and data centres) · BSI C5 Type 2 |
| OVH SAS (OVHcloud) Roubaix, France | DNS records for your domain | Your subdomain name; and, only on Managed AI, the text sent to an AI feature. Synchronous input/output is not stored, reused or used for training | 🇫🇷 France · group support perimeter: EU, UK and Canada | ISO/IEC 27001, 27017, 27018 and 27701 |
| IONOS Cloud GmbH Montabaur, Germany · inference in the Berlin data centre | Managed EU AI inference when you enable it | Only on Managed AI, the text sent to an AI feature. Synchronous input/output is not stored, reused or used for training. | 🇩🇪 Germany | ISO/IEC 27001 |
| o2switch Clermont-Ferrand, France | Email delivery for notifications and support | Your email address and the content of messages we send you | 🇫🇷 France | Owns and operates its Clermont-Ferrand datacenters, built to Tier 4-aligned availability requirements |
| Mollie B.V. Amsterdam, Netherlands · payment institution supervised by De Nederlandsche Bank | Processes the first checkout, payment mandate and recurring subscription payments | Your billing name, email, payment details and payment history. Never your business data | 🇳🇱 Netherlands | Payment institution supervised by DNB · PCI DSS Level 1 |
IONOS Cloud veröffentlicht eine vertragliche Anlage mit den benannten Unterauftragsverarbeitern seiner Dienste. Jeder Dritte muss dort oder in den dienstspezifischen Bedingungen genannt sein. IONOS-Cloud-Unterauftragsverarbeiter — Anlage UAV v6.2 ↗
About these certifications
Each entry links to the provider's own certification page, so you can check it rather than take our word for it. Two things are stated precisely on purpose. A certification held by a data centre is not the same as one held by the company operating it. And a certification that covers one product line does not cover the rest — OVHcloud's SecNumCloud qualification, for example, applies to its Hosted Private Cloud offering, which is not the service ReefOffice uses, so it is not claimed here. ReefOffice itself holds no security certification; it is too small to have been audited, and saying so is more useful than implying otherwise.
Managed AI: Modell und Nutzungsbedingungen
Managed EU AI leitet Essential und Plus derzeit an Mistral Small 24B Instruct auf der deutschen Infrastruktur von IONOS Cloud weiter. Die Modellgewichte stehen unter Apache 2.0 offen zur Verfügung. Vor der ersten Nutzung akzeptiert jeder Kunde die aktuellen ReefOffice-KI-Bedingungen, die Modelllizenz und die IONOS-Nutzungsbedingungen für KI-Dienste.
Why the jurisdiction matters, not just the location
A server in Frankfurt owned by a US company can still be reached by a US legal order under the CLOUD Act, because that law follows the company rather than the hardware. That is the gap most "EU region" marketing leaves open. Every supplier below is an EU-incorporated company operating EU infrastructure, so both the data and the company answer to EU law.
Who is not on this list
No advertising network, no analytics product, no US hyperscaler, and no AI provider that trains on customer data. ReefOffice runs no third-party tracking scripts on this website — there is nothing to consent to because nothing is collected.
Changes
We give at least 30 days' notice by email before adding or replacing any provider on this list. If you object and we cannot resolve it, you may terminate without penalty and take your data with you. See the Data Processing Agreement for the full terms.
Data Processing Agreement · Datenschutzerklärung · Sicherheit
Question about a specific provider?
Ask, and we will answer with the contract terms rather than a summary.