AUVYTrust Center

AUVYTrust Center

Trust you can review

EU-hosted workspaces, public processor disclosures, and the contracts buyers need — written for security, legal, and procurement review.

  • Core EU hosting
  • Public AVV / DPA
  • Processor register
  • AI transparency
security@auvy.aiPrivacy PolicyAVVChangelogHow AI works

Legal changelog & versions

Current document versions, the live subprocessor register, and a public history of material legal updates. Use this page to see what changed — and which text is binding.

Latest corpus release 10 Aug 2026Subprocessor register v3.1 (10 Aug 2026)Binding AVV: German Art. 28 text

Several documents share topics but not the same legal role. Mixing them is the usual source of inconsistent customer answers.

  • AVV vs DPA overview

    The German AVV (Art. 28) is the binding processor contract. The EN/DE “DPA overview” pages are short pointers only.

    Rule: On conflict, AUVY_AVV_DE.md wins. Never edit overview text as if it were the contract.

  • German AVV vs English DPA translation

    avv-de is binding German law text. avv-en is a courtesy translation with the same version number.

    Rule: Bump DE and EN AVV together. Never let the English translation invent extra obligations.

  • Live register vs AVV Anlage 3 snapshot

    trust.auvy.ai/subprocessors is the live register (own version, e.g. v3.1). AVV Anlage 3 / Annex 3 is a dated snapshot that must match.

    Rule: Change subprocessors.ts first, then mirror into AVV, PPN §7, DSH §7, and terms Annex C.

  • B2B vs B2C

    Business customers get AGB/GTC + AVV (processor). Consumers get B2C terms; AUVY is controller and the AVV does not apply.

    Rule: Do not paste AVV processor language into B2C privacy or consumer terms.

  • Product Privacy Notice vs Datenschutzhinweise

    EN PPN and DE DSH are paired controller notices with matching version numbers.

    Rule: Keep EN/DE privacy tables and register references in the same order as the live register.

  • Optional vs baseline processors

    “Optional” means data is sent only when a configured feature path is invoked — not that the vendor is inactive on the register.

    Rule: Removed vendors belong only in AVV Änderungslog / changelog history, never in the live baseline body.

  • OpenPulse

    OpenPulse is AUVY-operated EU infrastructure, not a separately verified third-party subprocessor.

    Rule: Describe in footnotes / residency copy; do not list as a contracting subprocessor row.

  • Marketing Impressum vs Trust imprint

    www.auvy.ai/legal is canonical for the marketing site. Trust imprint mirrors company particulars and links the product legal register.

    Rule: Do not redirect marketing /legal to Trust; keep particulars aligned.

Current published versions

Each file carries its own version number. EN/DE pairs must match. Dates below are the document header dates, not git commit times.

DocumentVersionUpdatedRoleLink
AGB Geschäftskunden (DE)1.510 Aug 2026termsOpen
AGB Privatkunden (DE)1.510 Aug 2026termsOpen
Auftragsverarbeitung — Überblick (DE)1.610 Aug 2026courtesyOpen
AVV Art. 28 DSGVO (DE)1.1010 Aug 2026bindingOpen
Business GTC (EN)1.510 Aug 2026termsOpen
Consumer GTC (EN)1.510 Aug 2026termsOpen
Data Processing Overview (EN)1.610 Aug 2026courtesyOpen
Datenschutzhinweise (DE)1.210 Aug 2026noticeOpen
DPA Art. 28 GDPR (EN courtesy)1.1010 Aug 2026courtesyOpen
Product Privacy Notice (EN)1.210 Aug 2026noticeOpen
Acceptable Use Policy (EN)1.13 Aug 2026policyOpen
Cookies (DE)1.13 Aug 2026policyOpen
Cookies (EN)1.13 Aug 2026policyOpen
Erstattungsrichtlinie (DE)1.13 Aug 2026policyOpen
Impressum (DE)1.13 Aug 2026policyOpen
Legal Notice (EN)1.13 Aug 2026policyOpen
Nutzungsrichtlinien (DE)1.13 Aug 2026policyOpen
Refund Policy (EN)1.13 Aug 2026policyOpen
Vulnerability Disclosure1.03 Aug 2026policyOpen
Widerrufsbelehrung (DE)1.13 Aug 2026policyOpen
Withdrawal Notice (EN)1.13 Aug 2026policyOpen
Subprocessor register (live)v3.110 Aug 2026RegisterOpen

Changelog

Material public updates. Older subprocessor narrative detail remains in the German AVV Änderungslog.

  1. 10 Aug 2026Corpus release

    Removed optional Firecrawl and E2B paths

    SideGuide Technologies (Firecrawl) and FoundryLabs (E2B) are removed from the live subprocessor register and mirrored legal annexes. Default web search remains Linkup (EU). Limited third-country processing continues to be documented for Resend account metadata and Vercel edge metadata.

    • Subprocessor register v3.0v3.1
    • AVV / DPA Art. 28 1.91.10
    • DPA overview 1.51.6
    • Privacy notices (PPN / DSH) 1.11.2
    • Business & consumer terms 1.41.5

    SubprocessorsAVV (DE)DPA overview

  2. 3 Aug 2026Subprocessors

    Register v3.0 — OpenPulse reclassified; Firecrawl & E2B disclosed

    OpenPulse described as AUVY-operated internal EU infrastructure (not a separate contracting subprocessor). Optional Firecrawl URL/PDF parsing and E2B sandbox execution added as production-capable AUVY paths. Unverified AWS backup mapping removed.

    • Subprocessor register v2.9v3.0
    • AVV 1.81.9

    AVV Änderungslog

  3. 3 Aug 2026Subprocessors

    Register v2.9 — OpenPulse baseline for realtime

    OpenPulse (EU / Helsinki) added as baseline for encrypted realtime collaboration, messaging, agent streams, and workspace notifications.

    • Subprocessor register v2.8v2.9
    • AVV 1.71.8

  4. 3 Aug 2026Subprocessors

    Register v2.8 — Linkup-only web search

    Product web_search / web_read exclusively via Linkup SAS (EU / Azure EU). Exa and Firecrawl removed from the baseline.

    • Subprocessor register v2.7v2.8
    • AVV 1.61.7

  5. 3 Aug 2026History

    Earlier register moves (v2.2–v2.7)

    Identity/product plane on AUVY-operated Hetzner hel1; OpenAI and Gladia removed from baseline inference routing; Exa then Linkup/Firecrawl web-search iterations. Full narrative remains in the German AVV Änderungslog.

    • AVV 1.11.6
    • Subprocessor register v2.2v2.7

    AVV (DE) Änderungslog