Subprocessors
This English translation is provided for convenience only. The German Subprozessoren page is the authoritative version.
Caserock Investigations GmbH & Co. KG
Version 1.5 · Last updated 28 October 2026
1. Sub-processors for client and matter data
| Service provider | Service | Modules | Place of processing |
|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg (Luxembourg) | AI inference (Amazon Bedrock); infrastructure for data transfer via SFTP | M0, M3, M5a, M5b, M5c, M6b | European Union |
| DeepL SE, Cologne (Germany) | AI-assisted translation (DeepL API) | M5a | European Union (Luxembourg, Ireland) |
| Farsight Technologies AG, Schlieren (Switzerland) | eDiscovery software Farsight ED (on-premises operation in Germany) including maintenance and support | M1a | Germany (on-premises); support access from Switzerland (adequacy decision, Art. 45 GDPR) |
| Google Cloud EMEA Limited, Dublin (Ireland) | Gemini Enterprise Agent Platform (Vertex AI until April 2026): AI inference with Gemini models | M6b | European Union |
| inSign GmbH, Marzling (Germany) | Electronic signature of contracts (advanced electronic signature under eIDAS) | all | Germany |
| KeySolution IT GmbH, Oftersheim (Germany) | IT operations and administration, including workstations, the central storage infrastructure, the Microsoft 365 environment and the transfer and data room platform; hosting of the eDiscovery platform and of data rooms; backup of the hosted servers | M0, M1a, M4, M7 | Germany; subcontractor in the United Kingdom (adequacy decision, Art. 45 GDPR) |
| Lineal Worldwide Holdings, Inc. (USA) | Provision of the eDiscovery platform (Relativity aiR); case support and IT forensics (only where Tier 1 is permitted) | M1b, M2 | Hosting in the European Union; processing entity in the United Kingdom (adequacy decision, Art. 45 GDPR) |
| T-Systems International GmbH, Frankfurt am Main (Germany) | Client-side encrypted backup (T Cloud Public, Open Telekom Cloud until January 2026) | M0, M7 | Germany; operations and support services also from other Member States of the European Union |
M6a Basic Models is delivered without external service providers for running the models. M3 and M5a to M5c run only locally in Tier 2 and Tier 3; service providers are used there only in Tier 1. The workstations and the central storage infrastructure are administered by the IT service provider (KeySolution IT GmbH); backups are encrypted and run via T Cloud Public. Under M6b, models are used via the Google platform only once the data protection configuration has been completed; until then, exclusively via Amazon Bedrock.
Groups headquartered outside the European Union
The following service providers belong to groups headquartered outside the European Union:
- Amazon Web Services EMEA SARL (Amazon.com, Inc., USA);
- Google Cloud EMEA Limited (Google LLC, USA);
- Lineal Worldwide Holdings, Inc. (USA);
- Farsight Technologies AG (Switzerland).
2. Service providers for our own business operations
These service providers support our own business operations. They are given access to client and matter data only at the instigation of our clients; where they may thereby become aware of information protected by professional secrecy, they are bound by a duty of confidentiality.
| Service provider | Service | Place of processing |
|---|---|---|
| Microsoft Ireland Operations Limited, Dublin (Ireland) | Microsoft 365 (email, Teams, document storage) | European Union (EU Data Boundary); support and security services also from third countries (standard contractual clauses, Art. 46 GDPR; EU-U.S. Data Privacy Framework, Art. 45 GDPR) |
| everii Switzerland GmbH (MOCO), Binz (Switzerland) | Project administration, time recording and invoicing | Switzerland (adequacy decision, Art. 45 GDPR) and European Union; subcontractors in the USA and the United Kingdom (standard contractual clauses, Art. 46 GDPR) |
Groups headquartered outside the European Union
The following service providers belong to groups headquartered outside the European Union:
- Microsoft Ireland Operations Limited (Microsoft Corporation, USA).
3. Changes
We inform our clients in text form at least 14 days before the engagement or replacement of a sub-processor takes effect. The objection procedure under § 6 of the respective contract applies. Every new version of this list is published here.
You can request notifications of changes and further information at info@caserock.tech.
4. Further information
On request, we provide our clients with further information in text form to the extent they need it to fulfil their obligations. This includes:
- the status of the data processing and confidentiality agreements;
- the retention terms of the service providers;
- the safeguards for third-country transfers in detail.
5. Earlier versions
6. Contact
Caserock Investigations GmbH & Co. KG, Rudolf-Diesel-Ring 10, 82266 Inning am Ammersee, Germany
Data protection officer: Baker Tilly Data Privacy GmbH, datenschutz-caserock@bakertilly.de