Last updated: September 29, 2026
This page lists the third-party services Attena uses to deliver the product. In line with the GDPR Art. 28 transparency requirement and the Google API Services User Data Policy, every Sub-Processor that may receive content from your Gmail account, your email, or data derived from them is named here, along with what it does, where it operates, what data it sees, and a link to its data-processing terms.
When we add or change a Sub-Processor that handles user content, we update this page. If you'd like advance notice of material changes, write to privacy@attena.app.
For the data-handling rules these Sub-Processors operate under, including Limited Use, no-train-on-user-data, and the four restricted exceptions to human access, see our Privacy Policy, especially §2 (Google API Services: Limited Use Disclosure) and §4 (Data Sharing and Disclosure).
Cloud hosting, managed PostgreSQL database, object storage — Germany
Since 19 September 2026, Attena's application servers, primary database and file storage run on IONOS Cloud (IONOS SE, Montabaur, Germany), with the servers in IONOS's Berlin data centre. All data Attena caches from your Gmail, calendar, and contacts — including message bodies, subjects, senders, and Attena-generated artifacts like AI summaries and drafts — is stored in IONOS's managed PostgreSQL database. Attachments and encrypted database backups are kept in IONOS Object Storage in Germany. OAuth tokens are encrypted at the application layer before being written, and Attena encrypts each attachment before uploading it, so IONOS only ever stores attachments as ciphertext. IONOS does not access this data except as required to operate the underlying infrastructure. A signed Art. 28 GDPR data-processing agreement (Auftragsverarbeitungsvertrag) with IONOS SE is in place.
Former VPS hosting (until 19 September 2026) — Germany / France
Until 19 September 2026, Attena's application servers and primary database ran on Strato (STRATO GmbH, Berlin — a German hosting provider in the United Internet group) within the European Union. That server has been shut down. Until it is decommissioned it still holds a copy of the data as it stood on that date, which is deleted at decommissioning. Strato does not access this data except as required to operate the underlying infrastructure. The signed Art. 28 GDPR data-processing agreement (Auftragsverarbeitungsvertrag) with Strato continues to cover it; Strato is ISO 27001 certified.
Strato uses Ionos SE (Montabaur, Germany, a sister United Internet company) as its underlying infrastructure provider for dedicated and virtual servers. A WHOIS lookup on the former server's IP shows Ionos SE as the network registrant; for that server STRATO GmbH remains our direct sub-processor under the AVV. Strato's other infrastructure sub-processors used in the VPS path are Hewlett-Packard GmbH (server hardware support, Germany), Virtuozzo International GmbH (virtualisation, Switzerland), and Plesk International GmbH (server admin software, Switzerland); the Swiss processors operate under EU Standard Contractual Clauses.
LLM inference for AI features: United States
When you use Attena's AI chat, AI triage (when opted in), or features powered by Claude, Attena sends the minimum necessary content, typically the message body, subject, sender, recipient, and surrounding thread context, to Anthropic's API for inference. Anthropic does not use API inputs or outputs to train its models. Anthropic retains API content for up to 30 days for abuse-monitoring purposes only, after which it is deleted.
LLM inference for AI features: United States
For AI features powered by open-weight models (briefings, dashboard summaries, channel summaries, draft suggestions, AI sentiment, triage, voice-profile learning, AI chat when configured), Attena sends content to Together AI's hosted inference API using OpenAI-compatible endpoints. The content sent is the same as for Anthropic: body, subject, sender, recipient, surrounding context.
Attena has opted out of Together AI's account-level data retention and product-improvement programs (effective 2026-05-29). On our account, Together AI is not permitted to retain prompts and responses for product improvement, and is not permitted to route our requests through passthrough models that would send data to other third-party providers. This is on top of Together AI's standard paid-API terms, which already exclude inference inputs and outputs from training data.
As of 16 September 2026, Attena no longer sends any content to Together AI. Both the AI features described above and search indexing (embeddings) now run on IONOS in Germany. See below. This entry is kept for transparency about processing that took place before that date.
AI features and search indexing — Germany
Attena uses the IONOS AI Model Hub for two things, both processed in Germany (IONOS's Berlin region) on open-weight models.
AI features. Summaries of your conversations, suggested reply drafts, briefings and related features send the message content they need — typically the body, subject, sender, recipient and surrounding thread context — to IONOS for processing. This is the same content that previously went to Together AI in the United States.
Search indexing. To make your messages searchable by meaning rather than just keywords, Attena converts each message into a numeric representation called an embedding. For this it sends the message's subject, sender address, and roughly the first 750 characters of the body — not full bodies, attachments or thread context. The same applies to search terms you type, so they can be compared against the index.
IONOS states that it does not retain or train on this content. In its published data-handling policy, IONOS says the content of prompts and generated outputs “is never logged and is never accessed by IONOS Cloud personnel”, is “not written to any log or to persistent storage”, and is “not used to train, fine-tune or otherwise improve any model”. IONOS runs these open-weight models on its own infrastructure, so the organisations that originally built them — Meta and BAAI — receive no data and have no access to it.
Before 16 September 2026 both of these were processed by Together AI in the United States. Moving them to IONOS keeps this content within the EU. AI chat and triage still use providers in the United States — see the Anthropic and Google entries on this page.
Backup for AI features — France
If IONOS's AI service is unavailable, Attena sends the AI-feature requests described in the IONOS entry above — the same message content — to Scaleway's Generative APIs in Paris instead, running the same open-weight model, until IONOS recovers. Search indexing (embeddings) is never sent to Scaleway.
Scaleway states that it applies zero data retention and does not train on this content. Its published policy says customer data “is not used for training, retraining, or improving the base models”. The one exception is a request that causes an error or is flagged for abuse, which Scaleway may keep for up to two weeks for debugging. Scaleway runs the model on its own infrastructure, so Meta receives no data.
Public-web background enrichment: United States
When the optional identity-enrichment feature is enabled for your account, Attena sends a meeting contact's name and company (for example, "Cari Davidson, Forward Earth") to Perplexity AI to retrieve publicly-available professional background. This happens in two cases: when you actively generate a meeting-prep brief, and automatically when Attena prepares the proactive meeting-prep email shortly before a meeting. Attena never sends your email content, such as bodies, subjects, senders, or thread context, to Perplexity; only the contact's name and company leave Attena. Results are cached for up to 30 days. This feature is off by default and is granted per account.
iOS push delivery: United States
When Attena sends an iOS push notification (new message, important sender, etc.), Apple receives a small payload containing the sender's display name and the message subject (or the first 100 characters of a preview when no subject exists). Apple delivers the notification to your device and does not retain payload content beyond delivery.
Android push delivery: Global
The Android equivalent of APNs. Google receives the same payload (sender + subject/preview) plus structural metadata (thread ID, normalized subject) needed to route you to the right thread when you tap the notification. Google does not retain FCM payload content beyond delivery.
Identity provider and source of your Google data: Global
Google authenticates you when you sign in with your Google account and is the origin of every piece of Gmail, calendar event, and contact data Attena processes on your behalf. We access this data via the scopes you grant on the consent screen (gmail.modify, calendar.events, contacts.readonly, plus openid email profile for sign-in); revoke at any time via myaccount.google.com/permissions.
If you sign in with a non-Google address: Varies
If you connect a Fastmail, Outlook, Yahoo, or self-hosted mailbox to Attena, that provider is the source of your email; Attena reads it via IMAP and sends through SMTP. Each user's IMAP/SMTP provider is determined by the user, not selected by Attena. Credentials are stored encrypted at rest on Attena's servers.
Product usage analytics: Global
Attena uses Google Analytics 4 to understand how features are used: which pages users visit, which buttons get clicked, which onboarding steps stall. GA4 receives page views, custom product events (such as opening the briefing or sending a chat message), and after you sign in your Attena user ID, so a session's events are linkable to your account. GA4 does not receive any Gmail content, message bodies, subjects, sender addresses, or contact information. You can opt out of GA4 collection site-wide by enabling your browser's "Do Not Track" signal or by installing the official Google Analytics Opt-out Browser Add-on.
Outbound transactional emails from hello@attena.app: Global
Account emails from Attena, including email-verification, password-reset, password-changed notifications, and (if you opt in) the daily briefing, are sent via the hello@attena.app mailbox on Google Workspace using Gmail SMTP. Google sees the recipient address (your account email) and the rendered email content. Inbound replies to support@ / privacy@ are also handled on Google Workspace.
Application error and crash reporting: Global
Attena uses Sentry to capture backend and web-app errors so they can be diagnosed and fixed, and to record sampled performance traces (roughly one request in ten): how long a request or page load took and which database queries ran underneath it. Sentry is deliberately hardened to keep your mail out of every payload: request bodies, cookies, client IP, query parameters, and stack-frame local variables are not transmitted, so message bodies, subjects, and sender addresses do not leave Attena's servers in an error report or a trace. Only an opaque Attena user ID is attached, so we can tell which account hit a bug, never your email content. Data is stored in Sentry's EU region.
For transparency, services Attena does not use today (and which would require an update to this page before adoption):
Questions about how Attena handles your data, or about any Sub-Processor listed here, go to privacy@attena.app.