Subprocessors

We engage the following subprocessors to deliver the Alethe AI agent platform. The list is updated whenever a subprocessor is added, removed, or changes country of processing.

Our standard, and where we stand against it. We require a Data Processing Agreement meeting Art. 28(3) GDPR to be in place with a subprocessor before it receives personal data from the platform. Data processing agreements are in place with subprocessors across this list, and we are working through the remainder. The status is published per subprocessor rather than as a single blanket claim: where a row is marked ⚠ DPA gap, no Art. 28 agreement is in place yet and that subprocessor is fenced to non-personal-data use until one is executed; where a row is marked ⚠ verify, we are confirming the position and apply the same fence in the meantime. This page reflects the position on the date shown above and is updated as each agreement is executed.

This list is referenced from our Privacy Policy and from our Data Processing Agreements (provided at onboarding; request at info@alethe.eu).

Core infrastructure (always engaged)

AI model providers (engaged when AI features are used — i.e. effectively always)

Search and research tools (engaged when customer agents invoke them)

Code execution (engaged only when an agent runs code)

Contact-data providers (engaged only when contact lookup is invoked)

Integration providers (engaged only when the customer enables the integration)

These process Customer Content only on the customer's explicit configuration (e.g. enabling a Meta Ads campaign module). Listed for transparency.

Observability and analytics

Email (transactional and marketing)

Transactional and marketing email providers will be added to this list before first use, with 30 days' notice to customers.

Notification of changes

Material changes (new subprocessor added; existing subprocessor changes country of processing; sub-processor decommissioned) are notified at least 30 days before taking effect, via:

• Update to this published list
• Email to active business customers' designated data-protection contact

In-product notification to organisation administrators is intended but not yet built; we do not list it as an operating channel until it is.

B2B customers have the right to object on reasonable data-protection grounds — the objection mechanism is set out in the DPA (provided at onboarding; request at info@alethe.eu).

Sub-subprocessors

Each subprocessor above may engage its own sub-processors (chip vendors, hosting providers, content-delivery networks). We require all subprocessors to disclose theirs in their respective DPAs and to flow the same Art. 28(3) protections to their sub-processors.

One place where that requirement is visibly unsatisfied. Our media supplier publishes a sub-processor list of 14 companies, none of which is an AI model provider, while publicly attributing model families to ByteDance, Kuaishou and others. Both cannot be complete. Either the supplier serves those weights on infrastructure it controls, or a separate company operates them and must be named. We have asked and do not yet have the answer, and we will not guess at it here.

Audit and TOM evidence

For customers under the inbound DPA, evidence of subprocessor security posture (SOC 2 reports, ISO 27001 certificates, recent pen-test summaries) is available on request to info@alethe.eu, subject to NDA where the subprocessor requires it.