Sub-processors

Our Sub-processors

CivAI B.V. uses the following sub-processors for its AI products and services. All sub-processors are bound by data processing agreements and are required to process personal data in accordance with the GDPR. CivAI recommends Scaleway as the default infrastructure provider. If preferred, Microsoft Azure can be offered as an alternative. We will notify customers of any intended changes to this list in advance.

Last updated: October 2026

Scaleway S.A.S.

Recommended

Reason for sub-processing Hosting, storage and AI inference

Country of processing France / Netherlands (EEA)

Personal data Account data, prompts/content, logs and files (depending on configuration)

Transfer instrument No transfer outside the EEA (default); EU Standard Contractual Clauses (SCCs) only if a sub-processor introduces a third-country element

Safeguards ISO 27001 (incl. published SoA), HDS (health data hosting), CSA STAR Level 1

Note

Preferred route — data remains within the EEA. Certifications verified against the Scaleway Trust Center on 13 September 2026.

Microsoft Ireland Operations Ltd (Azure / Azure OpenAI)

Reason for sub-processing Azure hosting and Azure OpenAI inference; only if agreed, also image generation

Country of processing Sweden (Sweden Central region); processing within the EU Data Zone (EU member states, Norway and Switzerland)

Personal data Prompts/outputs, logs and technical metadata (depending on the chosen configuration)

Transfer instrument Processing by Microsoft Ireland within the EU Data Zone; an adequacy decision applies to Switzerland. For any third-country transfer or access: EU Standard Contractual Clauses (Module 3) with supplementary measures based on a DTIA

Safeguards ISO 27001, SOC 2, C5, SCCs

Note

Optional route, only on request. Scaleway is the default and is recommended. The resource is located in the Sweden Central region (Sweden); all AI inference (text, speech, embeddings and images) runs exclusively through Data Zone Standard deployments within the EU Data Zone (EU member states, Norway and Switzerland). Image generation (gpt-image-1.5) is used exclusively as laid down in the agreement with the client. The parent company Microsoft Corporation is established in the United States. An additional assessment / DTIA is therefore carried out where relevant, in view of the US Cloud Act.

Stripe Payments Europe, Ltd.

Reason for sub-processing Payment processing for individual subscriptions (checkout, recurring charges, receipts, customer portal)

Country of processing Ireland (EEA); Stripe, Inc. (United States) as group company

Personal data Name, e-mail address, payment method, transaction and payment status data. CivAI does not receive full card or account numbers

Transfer instrument EU Standard Contractual Clauses and EU-US Data Privacy Framework certification of Stripe, Inc. for intra-group transfers

Safeguards PCI DSS Level 1, SOC 2, SCCs, DPF

Note

Used only for individual subscriptions (B2C), not for business customers invoiced by CivAI. For fraud prevention and its own legal obligations, Stripe also acts as an independent controller.

Mailgun Technologies, Inc. (Sinch), EU region

Reason for sub-processing Transactional e-mail: newsletter, confirmations and notifications

Country of processing EU region (EEA); parent company established in the United States

Personal data E-mail address, name, message content and delivery logs

Transfer instrument EU processing; EU Standard Contractual Clauses for any third-country access

Safeguards SOC 2 Type II, SCCs

Note

E-mail only. No prompts, content or output are sent through Mailgun.

Changes to Sub-processors

CivAI will inform its customers at least 30 days in advance of any intended addition or replacement of sub-processors, giving customers the opportunity to object. If you wish to be notified of changes to this list, please contact us.

Questions?

For questions about our sub-processors or data processing, contact us at privacy@civai.eu.