This list is Annex 3 of our data processing agreement.
A sub-processor is a company that processes your organisation’s content for us. Your organisation authorises this list when it accepts the terms. We tell you by email at least 30 days before we add or replace a sub-processor, and you can object (see section 5 of the agreement). Each sub-processor receives only the data it needs for its purpose.
They process your content
| Sub-processor | Purpose | Data | Where | Legal entity | Transfer basis |
|---|---|---|---|---|---|
| Railway | Hosting and infrastructure | Your content | Amsterdam, the Netherlands (EU West). Traffic enters through Railway’s edge network, at the edge nearest to the user. Railway’s control plane, platform logs and support work largely from the United States | Railway Corporation, San Francisco, United States | EU–US Data Privacy Framework for the parts in the United States |
| Requesty | AI model gateway | Text sent to AI models, with names replaced | Frankfurt, Germany | Requesty Ltd, London, United Kingdom (company 15165717) | UK adequacy decision of the European Commission: Implementing Decision (EU) 2021/1772, renewed by Implementing Decision (EU) 2025/2574 until 27 December 2031 |
| Microsoft, through Requesty | AI models | Text sent to AI models, with names replaced | France Central and Germany West Central | Microsoft Azure AI, as Requesty’s sub-processor list names it | In the EEA |
| TensorX, through Requesty | AI models | Text sent to AI models, with names replaced | Dublin, Ireland, and Helsinki, Finland | TensorX Ltd, Dublin, Ireland (company 796387) | In the EEA |
| Lyceum, through Requesty | AI models | Text sent to AI models, with names replaced | The European Union, by Requesty’s model listing | Lyceum Technology, Berlin, Germany | In the EEA |
None of these companies may use your content to train a model.
They process account data only
For account data we are the controller, not your processor. We list these companies so that the picture is complete.
| Sub-processor | Purpose | Data | Where | Legal entity | Transfer basis |
|---|---|---|---|---|---|
| Cloudflare | Account emails, and the bot check on sign-up, sign-in and password reset | Email address, IP address and signals from the browser | Cloudflare’s global network | Cloudflare, Inc., San Francisco, United States | EU–US Data Privacy Framework |
Cloudflare never receives an upload, a question or an answer.
Not a sub-processor
Freemius, Inc., Wilmington, United States, sells paid plans and credit packs as reseller and merchant of record. It receives the purchase data only, under its own privacy notice. It never receives your content.