Licensed to be used in conjunction with basebox, only.
// security
Data processing & sub-processors
Applies to
Product: Cloud · Server · Audience: Data protection officers · Security / Compliance reviewers · Decision makers
Who processes which data on whose behalf at basebox: the role of basebox, your role, the data processing agreement (DPA) and the sub-processors involved per product. Not legal advice.
Roles
- You are the controller within the meaning of the GDPR. You determine which data is processed in basebox and for what purpose.
- basebox processes personal data as a processor when basebox operates your environment or has access to it – always in basebox Cloud, on a basebox Server when basebox operates or maintains it remotely.
- basebox uses sub-processors only with your approval.
The DPA
The DPA is automatically part of every contract. Text: basebox.ai/en/dpa. The current list of sub-processors is available as a PDF: List of sub-processors. For decision makers there is an overview at basebox.ai/en/security; detailed questions at basebox.ai/sicherheit/fragen.
The DPA and the PDF list are authoritative. The tables below explain who has which task in which product.
Who processes what – per product
basebox Cloud
| Party | Role | What |
|---|---|---|
| basebox GmbH | Processor | Operation of platform, service models and language model; updates, backups, monitoring |
| noris network AG, data center Munich-East | Sub-processor | Space, power, connectivity |
| FAST LTA | Sub-processor | Hardware partner: the servers are owned and serviced by FAST LTA |
| Providers of additional compute, e.g. STACKIT or Mistral AI in the EU, or a provider you choose | Sub-processor, only with your approval | Additional compute |
Details: Cloud · Infrastructure.
basebox Cloud (transition phase until November 2026)
| Party | Role | What |
|---|---|---|
| basebox GmbH | Processor | Operation of the environment |
| Hetzner, Nuremberg | Sub-processor | Shared environment: logically separated, shared user management |
| Google Vertex AI, Frankfurt | Sub-processor | AI models: model requests go to Google Vertex AI |
Accounts created before the Cloud launch in November 2026 run in this shared environment until the move (Transition phase). basebox moves them to the Cloud described above. Health data and other special categories of personal data (Art. 9 GDPR) are best processed only after the move.
basebox Server in your house
| Party | Role | What |
|---|---|---|
| Your organization | Controller and operator | Server, data, operation in your own network |
| basebox GmbH | Processor only when it has access | Remote maintenance or operation, when commissioned and approved by you (Remote maintenance); without access no processing by basebox |
| Others | – | No sub-processors through basebox as long as basebox has no access. External services you connect yourself (e.g. an external model endpoint) you assess yourself (Model providers) |
Details: Customer data center.
basebox Server in a data center operated by basebox
| Party | Role | What |
|---|---|---|
| basebox GmbH | Processor when basebox operates or maintains the server | Providing the data center space; operation of the server when commissioned |
| noris network AG, Munich (default) | Sub-processor | Space, power, connectivity |
| FAST LTA | Sub-processor, if the hardware comes from FAST LTA | Hardware and servicing |
Details: Hosting at basebox.
For the review
- Determine product and location; this gives you the table above.
- Take the DPA and the PDF list of sub-processors into your record of processing activities.
- In the Cloud transition phase: process Art. 9 data only after the move.
- Changes to the list: sub-processors are added only with your approval.
Questions about the DPA and sub-processors: datenschutz@basebox.ai.
Next step: GDPR · Data flows