Appendix A

Services Used / Subprocessors

Version: April 2026

This Appendix describes the services and subprocessors used by sisTent UG in connection with the provision of the services. This Appendix forms part of the Terms and Conditions and the Data Processing Agreement (DPA). Any changes will be announced to customers at least 10 business days prior to taking effect. Customers have the right to object within this period.

1. Large Language Models (LLMs)

Service ProviderModel / ServiceData ProcessedPurpose
GoogleGemini /Vertext AIUploaded documents, chat requests, conversationsGeneration of text responses, natural language processing
Amazon Web ServicesNova Micro / BedrockUploaded documents, chat requests, conversationsGeneration of text responses, natural language processing

Note: All LLMs are used solely on behalf of the customer. Data is not used for training outside the respective customer project.

2. Embedding Services

Service ProviderModel / ServiceData ProcessedPurpose
GoogleGemini Embeddings /Vertext AIDocument chunks, text segmentsCreation of vector representations for semantic search (RAG)
Amazon Web ServicesTitan v2 / BedrockDocument chunks, text segmentsCreation of vector representations for semantic search (RAG)

3. Data Storage

Service ProviderServiceDataPurpose / Processing
Amazon Web ServicesS3Uploaded documents, chunks, embeddings, backups, application dataPersistent storage of customer data and application components
Amazon Web ServicesEC2 / PostgreSQLChunks, embeddings, agent configurations, chat histories, user accountsStorage and management of customers’ relational data

4. Application Deployment

Service ProviderServiceComponentPurpose / Processing
Amazon Web ServicesEC2Web / App PlatformHosting of the application, provision of the user interface for customers

5. Key Management and Encryption

Service ProviderServiceDatenPurpose
Amazon Web ServicesSecrets ManagerCryptographic keysThe management of cryptographic keys is handled separately from the stored data.

Zugriffe auf Schlüssel sind strikt kontrolliert und auf autorisierte Systeme und Personen beschränkt.