Legal · Annex A

Sub-Processors

Last updated: April 21, 2026 · Document version Beta v0.1

We engage sub-processors under written contracts that obligate them to data protection standards equivalent to ours. To preserve operational flexibility and protect commercially sensitive vendor relationships, the public list is presented by category. A current detailed list of sub-processors, including specific entity names, contact information, locations, and applicable privacy notices, is available within seven (7) business days of a written request to [email protected]. Customers under signed Data Processing Agreements (DPAs) receive automatic notification of additions or material changes at least thirty (30) days in advance.

We will notify users at least 30 days before adding any new sub-processor that processes personal data, unless emergency security or legal compliance requires faster action.

Sub-Processor	Purpose	Location	Privacy
Third-Party AI Model Providers	Large language model inference, vision processing, embeddings, and related AI workloads	Multiple regions, worldwide	Detailed list available on request to [email protected]
Cloud Infrastructure & Edge Network	Compute, storage, content delivery, DDoS protection, and edge serverless execution	Multiple regions, worldwide	Detailed list available on request to [email protected]
Managed Database Hosting	Hosted PostgreSQL with point-in-time recovery and replication	Multiple regions, worldwide	Detailed list available on request to [email protected]
Payment & Banking Processors	Card processing, subscription billing, payouts, and banking services for the operating entity	Multiple regions, worldwide (regulated providers)	Detailed list available on request to [email protected]
Search & Data Enrichment APIs	Live web search, page retrieval, and structured data enrichment for the Arachne web agent and Adam research workflows	Multiple regions, worldwide	Detailed list available on request to [email protected]
Speech & Transcription Services	Speech-to-text transcription for voice features	United States	Detailed list available on request to [email protected]
Email & Notification Delivery	Transactional email, password resets, and account notifications	United States and European Union	Detailed list available on request to [email protected]

Each sub-processor is bound by a written Data Processing Agreement (DPA) with Tokra, LLC that imposes data protection standards equivalent to ours. Cross-border transfers (e.g., to U.S. AI providers) rely on Standard Contractual Clauses (EU), the UK IDTA / Addendum, or other lawful mechanisms per Section 9.6.