Last updated: 9 July 2026
A sub-processor is a third party we engage to help provide the Service and that may process personal data on your behalf. This page is the current list that our Data Processing Agreement (Annex C) refers to. We impose data protection obligations on each sub-processor equivalent to those in the DPA, and we remain liable to you for their performance.
These providers are part of the processing path for every organization. The application, database, and EU-sovereign model serving all run on EU infrastructure.
| Sub-processor | Purpose | Personal data | Region |
|---|---|---|---|
| Amazon Web Services | Cloud hosting for the application and database. | Content you send through the platform, account data, and usage records. | EU (Frankfurt, eu-central-1) |
| Brevo | Transactional email delivery (account, verification, and system mail). | The email addresses that receive account and system mail, and the content of those messages. | EU (France) |
| Mistral AI | EU-sovereign model inference and memory fact extraction. | The content you send to the EU models, and the conversation text used to extract memory facts. | EU (France) |
| Cloudflare | CDN, DNS, and WAF. | Request metadata and IP addresses. | Global edge network, US entity (SCCs) |
| Stripe | Subscription billing and payment processing. | Billing contact, company details, and payment metadata. | EU and US (SCCs) |
| Google Workspace | Business email and customer support communications. | Contact details and the content of messages you send us. | EU and US (SCCs) |
| PostHog | Product and website analytics, only with your consent. | Usage events and, for signed-in users who accept analytics, account identifiers (name, email, and organization). | EU (EU Cloud), US entity (SCCs) |
| Sentry | Error monitoring and application logging. | Error and log diagnostics; personal data is minimized and not intentionally collected. | EU data region, US entity (SCCs) |
These providers are never in the path by default. A request reaches an external or non-EU model only when you have allowed it for that traffic, with personal data pseudonymized by the PII firewall or a recorded acknowledgment on file. The egress guard blocks the transfer otherwise. When you enable external routing, you act as controller for that transfer.
| Sub-processor | Purpose | Region |
|---|---|---|
| OpenAI | External model inference, when you route to it. | US (SCCs) |
| Anthropic | External model inference, when you route to it. | US (SCCs) |
| Google (Gemini) | External model inference, when you route to it. | US (SCCs) |
The infrastructure that holds your data is EU-resident. Where a sub-processor is established outside the EU, or where you instruct routing to a non-EU model, the transfer relies on an appropriate mechanism such as the Standard Contractual Clauses, together with the technical measures described on our Security and Trust page.
Before we add or replace a sub-processor, we give advance notice so you can object on reasonable data protection grounds. Turn on DPA change notifications in your account, under Settings then Notifications, to receive these by email. This page always reflects the current set of sub-processors, with the date it last changed shown at the top.
For the signed DPA and its annexes, or to raise an objection to a sub-processor, contact legal@akumi.cloud or your account contact.
We use privacy-friendly, EU-hosted analytics to understand how Akumi is used. Accept analytics cookies, or continue without them. See our cookie policy.
