Subprocessors
Die deutsche Fassung ist massgebend / The German version is binding. Binding German version
This list belongs to the Data Processing Agreement (DPA, section 7). It names the companies we engage to operate Tessa Cloud and that may process personal data on our behalf in doing so. We announce changes at least 30 days in advance with a new version of this list. Every version stays available at its address; all changes are listed in the changelog.
Subprocessors for your customer content
These companies may process personal data from your customer content on our behalf (DPA, section 7).
| Company | Purpose | Place of processing | Basis |
|---|---|---|---|
| Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany | Hosting of the Tessa Cloud server, databases, artifacts, and backups | Germany and Finland (EU) | Processing in the EU; data processing agreement with Hetzner |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | DNS and delivery (edge) for Tessa Cloud and our websites; bot protection (Turnstile) at signup | USA and EU locations | Data processing agreement (Data Processing Addendum) with the EU standard contractual clauses and the Swiss addendum |
Further service providers we use as controller
These companies do not process customer content but data for which we are the controller ourselves (DPA, section 2.2). We name them for transparency; details are in the Privacy Notice for Tessa Cloud.
| Company | Purpose | Place of processing | Basis |
|---|---|---|---|
| Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland | Billing, payment processing, billing portal, invoices | Ireland (EU); Stripe may process data within the Stripe group, including in the USA | Data processing agreement with Stripe with the EU standard contractual clauses and the Swiss addendum for transfers outside the EU |
Hosting in Switzerland (Enterprise): where the order form provides for hosting in Switzerland, we name the data centre provider there and add it to this list before it processes data of your organisation.
Not subprocessors
The following services process data from your organisation, but not on our behalf. You contract them yourself; their terms apply between you and the provider.
- Your AI provider, which you configure in the product with your own API key (for example Anthropic, OpenAI, OpenRouter, Microsoft Azure, Google Cloud, or an OpenAI-compatible endpoint). Tessa Cloud transmits data from your test runs to it on your behalf.
- GitHub or GitLab integrations you configure for issues (Tessa GitHub App, GitLab access token).
- Google and GitHub as sign-in providers: your users sign in with the account of their choice; the provider processes the sign-in under its own terms.
- Your own identity provider for Enterprise single sign-on: you operate or contract it yourself.
Changes
When a subprocessor is added or replaced, we publish this list in a new version at least 30 days before the change takes effect and inform the owners of your organisation in the product. Your right to object follows section 7.2 of the DPA.