01Scope and timeliness
This overview describes essential categories and currently planned technical service providers who can process personal data on behalf of AEGIS OS. The specific use depends on the scope booked, the customer configuration and the activated integrations.
Status: September 19, 2026. Before a significant change to order processing, information will be provided in accordance with the order processing agreement. Detailed contractual documents and transmission mechanisms can be requested via [email protected].
02Self-hosted AEGIS infrastructure
Purpose: Operation and technical delivery of AEGIS OS, including authentication, database, file, function, container and runtime services.
Affected data: Account, tenant, application, file, log, security and functional customer data as required by the respective use.
Status: The core application is self-hosted and operated by AEGIS-SECURITAS. If additional hosting, data-center, network or infrastructure processors are used, they are identified in this overview before or when they enter productive use. A specific exclusive data region is only promised if expressly agreed and technically confirmed.
03Resend
Purpose: Sending transactional emails, in particular account, invitation, support, appointment, contract and system messages.
Data affected: recipient address, sender information, subject, message content, shipping and delivery information and technical metadata.
Status: Used when the respective email function is activated and configured. Additional legal bases and processes are required for newsletters or other advertising communication.
04Stripe
Purpose: Subscription, payment, billing, fraud prevention and optionally Stripe Connect features.
Data affected: contract, customer, transaction, payment, device and security data. Complete payment instrument data is generally processed by the payment service provider.
Status: Depending on the processing, Stripe can act as a processor, an independent controller or in a mixed role. The specific payment flow and the Stripe contract documents are decisive.
05Optional identity and work integrations
Possible services: Google Workspace, Microsoft 365, Slack, HubSpot and other explicitly approved connectors.
Purpose: Login, calendar, email, file, communication, CRM and workflow functions.
Data Affected: Only the account, content, file, contact, calendar, and log data required for the selected connector and authorized actions.
Status: These services are only used after conscious connection by an authorized customer administrator. The scope and responsibility roles also depend on the conditions of the respective provider. The customer can revoke connections; Data stored by the third-party provider may need to be managed separately there.
06AI processing
Purpose: Analysis, extraction, summary, recommendation, structuring or text creation requested by the user.
Affected data: inputs, shared company data, files and conversation context, insofar as these are transmitted for the selected AI function.
Status: The specific technical AI processing is provided via the integration provided in the platform. Customers may only release sensitive or special categories of personal data if the processing is lawful, necessary and covered by the agreed scope of protection. Details about the active processing can be requested via the data protection contact.
07Services integrated by the customer themselves
If a customer connects their own webhooks, APIs, email, cloud, payment, communication or other services, they may be responsible for this and may be obliged to agree on their own order processing.
AEGIS-SECURITAS does not automatically check the legal basis of each service connected by the customer. Access should be limited to the necessary extent, checked regularly and revoked if the purpose no longer applies.
08Third country transfers and objection
If processing takes place outside the European Economic Area and no adequacy decision applies, the appropriate guarantees required by law, in particular standard contractual clauses and necessary supplementary measures, will be used.
Corporate customers can object to a significant change for important data protection reasons in accordance with the AVV. If no appropriate alternative is possible, the rights regulated there apply to the affected part of the service.
