Attachment to the company data information September 26, 2026
Service providers and processing locations
Operation and storage
Frey & Graf GmbH und Co. KG runs the Klarvexo application, PostgreSQL database and central file storage on a shared, logically separated server installation by company. Documents are stored on the server in the verified central operation; An external document SFTP storage is not set up centrally there. Individual company connections may vary.
Separate encrypted emergency backup uses a backup destination called STRATO VPS. According to this operational configuration, the provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. The specific main server contract, the associated data center locations and the assignment of both servers to the contract account have not yet been conclusively documented. No binding processing location can be derived from a server name, an IP address or the location of the provider. Exclusive Germany or EU processing is therefore not guaranteed.
System emails
Access, confirmation and system messages are sent centrally via STRATO via an encrypted SMTP connection. The required recipient addresses and message content are processed. However, the mail provider you have set up applies to the mailboxes connected to your company; STRATO is not automatically the provider of all customer mailboxes.
For a server order associated with the Klarvexo domain, order and activation records from July 2026 and accompanying data processing agreements are available. According to STRATO on contractual issues The AVV will automatically be included in contracts from July 18, 2022. The associated original versions remain decisive for the comparison; a public website does not replace it. The exact assignment of both running servers and the system mail account to the individual contracts is not yet fully proven. STRATO also publishes its Protective measures.
AI and document recognition
The central AI connection uses the OpenAI API. Depending on the activated process, required email, contact, project and document content including images as well as the results generated from them can be processed. The connection uses the common API endpoint, not a proven EU-exclusive endpoint.
According to OpenAI's published Data Processing Addendum For customers in the EEA, OpenAI Ireland Ltd. Contractual partner. Transfers outside the EEA are possible; The DPA describes adequacy decisions or standard contractual clauses for this purpose. The specific contract assignment and the settings of the API account used are not proven by a functioning API key alone.
OpenAI describes in his API data controls a standard abuse logging of up to 30 days with exceptions. According to the provider, API content is not used for model training by default; Voluntary data release can change this. There is no evidence of a zero storage agreement, EU-exclusive processing, or account-specific release status for Klarvexo. No corresponding assurances are given.
Push and optional device functions
Apple Push Notification service (APNs) is set up centrally for iOS. Apple receives device-related push identifiers and the relevant notification upon delivery. In the checked server flow, the mail push contains a general note instead of a subject or message body, as well as technical references to opening the process. Other types of notifications may contain different content. The Apple contractual documents of the developer account used apply to the exact legal role and international processing; This does not replace an examination of these account documents.
Firebase Cloud Messaging for Android is not set up in the central server version checked on September 26, 2026. The optional Android document scanner independently uses Google ML Kit via Google Play Services. Image processing on the device does not mean that no technical usage data goes to Google. The details and the alternative without ML Kit are in the Privacy Policy.
Services chosen by your company
Own mailboxes, calendars, SFTP storage, banking, WhatsApp, webhooks and shared portals can include additional recipients. An available function does not prove a connection has been established. Before the connection, recipients, data volume, authorizations, contractual relationships and, if necessary, third country bases must be clarified. This overview does not generally declare such services to be subcontractors of Klarvexo.
Contract related list
A binding subcontractor list must contain the legal entities actually used, tasks, locations and basis for transmission of the specific contract. Unclarified information is not approved by this acknowledgment. Contact for the documented contract status and protection guarantees: info@sc-v.de.