Legal · Annex A
Sub-Processors
Last updated: April 21, 2026 · Document version v1.0
We engage sub-processors under written contracts that obligate them to data protection standards equivalent to ours. To preserve operational flexibility and protect commercially sensitive vendor relationships, the public list is presented by category. A current detailed list of sub-processors, including specific entity names, contact information, locations, and applicable privacy notices, is available within seven (7) business days of a written request to [email protected]. Customers under signed Data Processing Agreements (DPAs) receive automatic notification of additions or material changes at least thirty (30) days in advance.
We will notify users at least 30 days before adding any new sub-processor that processes personal data, unless emergency security or legal compliance requires faster action.
| Sub-Processor | Purpose | Location | Privacy |
|---|---|---|---|
| Third-Party AI Model Providers | Large language model inference, vision processing, embeddings, and related AI workloads | United States, European Union, United Kingdom, and Asia-Pacific regions | Detailed list available on request to [email protected] |
| Cloud Infrastructure & Edge Network | Compute, storage, content delivery, DDoS protection, and edge serverless execution | United States and global edge regions | Detailed list available on request to [email protected] |
| Managed Database Hosting | Hosted PostgreSQL with point-in-time recovery and replication | United States | Detailed list available on request to [email protected] |
| Payment & Banking Processors | Card processing, subscription billing, payouts, and U.S. banking services for the operating entity | United States (regulated) | Detailed list available on request to [email protected] |
| Search & Data Enrichment APIs | Live web search, page retrieval, and structured data enrichment for the Arachne web agent and Adam research workflows | Various (United States and European Union) | Detailed list available on request to [email protected] |
| Speech & Transcription Services | Speech-to-text transcription for voice features | United States | Detailed list available on request to [email protected] |
| Email & Notification Delivery | Transactional email, password resets, and account notifications | United States and European Union | Detailed list available on request to [email protected] |
Each sub-processor is bound by a written Data Processing Agreement (DPA) with Tokra, LLC that imposes data protection standards equivalent to ours. Cross-border transfers (e.g., to U.S. AI providers) rely on Standard Contractual Clauses (EU), the UK IDTA / Addendum, or other lawful mechanisms per Section 9.6.
© 2026 Nourva. · Questions: [email protected]