Gelhaus Solutions Trust centre

Legal texts

Data processing at Gelhaus Solutions

What Gelhaus Solutions process for business customers under the Gelhaus Solutions data processing agreement, and who helps them. This page changes at the same time as a notice of a new sub-processor.

The processing

What for
  • Providing the hosted services the Customer uses under the Main Agreement, supporting the Customer, and keeping the services secure and available. No other purpose.
  • Hosting and operating, in Germany, the hosted services the Customer uses: storage, organisation, retrieval, use and display of the data in the service; its transmission to the recipients the Customer chooses and to the Sub-processors in Schedule 3; backups; support; erasure.
Personal data
  • account and profile data of the Customer's users: name, email address, user name, profile image and roles
  • content and files that the Customer and its users put into the hosted services, and the personal data contained in them
  • request logs with IP address, user agent and time, kept for at most 30 days
  • audit logs of administrative actions
  • the further categories stated in the processing annex of each hosted service the Customer uses, published at gplatform.org and listed at gplatform.org/dpa, in the version in force when this agreement takes effect
People concerned
  • the Customer's users, members and staff who use the hosted services
  • persons whose data the Customer or its users put into the hosted services, such as the reporters of vulnerabilities in GAdvisory
  • the further categories stated in the processing annex of each hosted service the Customer uses, published at gplatform.org and listed at gplatform.org/dpa, in the version in force when this agreement takes effect
How long
  • Content and accounts: for as long as the Customer uses the hosted service, and at the end of the Service as the clause “Return and deletion” provides
  • Request logs: at most 30 days
  • Audit logs: as stated in the processing annex of the hosted service concerned (GAdvisory: 24 months)
  • Backups: as stated in Schedule 2

Who is responsible

Controller
Each business customer, for the personal data it processes with Gelhaus Solutions
Processors
Gelhaus Solutions, Eichenwald 3, Löningen, 49624, Germany

Sub-processors

8 sub-processors, last changed 22 Oct 2026
CompanyWhat forWhereServicesSafeguardState
Cloudflare, Inc.DNS hosting for our domains and nothing else: it answers which address belongs to a name. None of our services' pages, mail, files or other traffic passes through it, and no content of a service reaches itWhich names of our domains are looked up; no content of a serviceUSAEvery serviceEU-US Data Privacy Framework (Cloudflare, Inc. is certified)In use since 17 Oct 2026
Functional Software, Inc. (Sentry)Error reports of the hosted services that use itError reports of the hosted services that use it, as far as they contain Customer Personal DataEU (Sentry's EU data region), access from the USA possibleGAdvisory, GAnalytics, GOpenCDR, GOpenCNR, GOpenCSR, Contribution Checker and Discord TicketsEU-US Data Privacy Framework (Functional Software, Inc. is certified); EU standard contractual clauses in Sentry's data processing agreementIn use since 17 Oct 2026
GitHub, Inc.Private fixes (Advisory Patch) made in GitHub mode, and only those: it stores the private copy of the repository and the invitations to it, in the GitHub organisation we keep for private fixes. In the native mode, which we host ourselves, GitHub receives nothingThe private copy of a repository for a fix and the invitations to itUSAGAdvisoryEU-US Data Privacy Framework (GitHub, Inc. is certified)In use since 20 Oct 2026
Google LLC (Gemini), through OpenRouterThe AI features of GAdvisory, which are enabled on the hosted service: OpenRouter routes them to GeminiPrompts and outputs of the AI featuresUSAGAdvisoryEU-US Data Privacy Framework (Google LLC is certified)In use since 20 Oct 2026
Groq LLC, through OpenRouterAI tasks of Contribution Checker, only where a project enables one, which is off by default for every task: OpenRouter routes them to Groq. Where it is off, nothing reaches itPrompts and outputs of the AI tasks a project enablesUSAContribution CheckerStandard contractual clauses in OpenRouter's data processing agreementIn use since 20 Oct 2026
IONOS SERented servers in data centres in Germany for the hosted servicesCustomer Personal Data of the hosted services that run on the rented serversGermanyEvery serviceNone needed: processing in the EUIn use since 17 Oct 2026
OpenRouter, Inc.The AI features of GAdvisory and contribution-checkerPrompts and outputs of the AI features, passed on to the model provider (Google or Groq)USA, and the model providers it routes to: Google and Groq, USAGAdvisory and Contribution CheckerEU standard contractual clauses (Module Two) in OpenRouter's data processing agreement, signed 20 October 2026In use since 17 Oct 2026
Stripe Payments Europe, LimitedTwo things, and the annex of GPlatform Billing says which is which: our processor for the customer record it holds for us, for issuing and numbering invoices, and for the billing portal; a controller in its own right for the payment instrument and for screening a payment for fraudThe customer record for invoices and the billing portalIrelandGPlatform BillingWithin Stripe's group, the safeguards in Stripe's data processing agreementIn use since 20 Oct 2026

The latest changes

All changes

  1. OpenRouter, Inc.: changed

    Changed on 22 Oct 2026: which services use it. Used for: The AI features of GAdvisory and contribution-checker.

  2. Functional Software, Inc. (Sentry): changed

    Changed on 22 Oct 2026: where it processes and which services use it. Used for: Error reports of the hosted services that use it.

Follow them as RSS, Atom, JSON