We engage the sub-processors below to provide the service. We give advance notice of changes to this list (see the DPA). DPF certifications must be renewed annually — verify a vendor’s current status on dataprivacyframework.gov before relying on it.
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Amazon S3) | Object storage for audio files and derived artefacts | EU (eu-west-1, Ireland) | Processed in the EU. US parent covered by EU-US DPF + SCCs. |
| ElevenLabs | Speech-to-text transcription | EU / USA | EU-US Data Privacy Framework + SCCs. |
| Anthropic, PBC (Claude) | LLM processing for summaries, chat and agents | USA | EU Standard Contractual Clauses (Modules 2 & 3); not DPF-certified. |
| Google (Gemini API) | LLM processing for selected generation tasks | EU / USA | EU-US Data Privacy Framework + SCCs. |
| Qdrant | Vector database for semantic search | EU | Processed in the EU. |
| MongoDB | Application database | EU | Processed in the EU. |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | EU / USA | EU-US Data Privacy Framework + SCCs. |
Questions about our sub-processors? Contact info@vertimas.io.