Sub-processors
Last updated 2026-10-28
What is on this page
A sub-processor is a company we have appointed to help run Botseon, which handles your data on our instructions. This page lists all of them, what each one does, where it runs, which company we actually contract with, and what makes the arrangement lawful. The Data processing addendum is the contract this list belongs to.
At the bottom there is a second list, of places a member of your organisation may choose to connect a bot to. Those are not sub-processors: your member picked them, not us.
Where a cell below cites a provider's own published document, the URL and the date we read it are given in the cell. Where no citation appears, the statement is our own description of the arrangement and has not been re-read against that provider's published document for this version of the page. We say which is which rather than presenting both the same way.
Running the service
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | AWS eu-central-1, Frankfurt | Database, authentication and file storage | Standard Contractual Clauses, Module Two and Module Three (https://supabase.com/legal/customer-resources/data-processing-addendum, as published on 2026-09-06) | Backups per plan; on project deletion Supabase removes all associated data including backups |
| Vercel Inc. (United States) | fra1, Frankfurt | Hosting for botseon.com and for the web app | Standard Contractual Clauses, Module Two and Module Three, plus an active EU–US Data Privacy Framework certification (https://vercel.com/legal/dpa, as published on 2026-09-06) | Request logs per Vercel's own schedule |
| Fly.io, Inc. (United States) | fra, Frankfurt | The computer each bot works on, and the live view of its screen | EU–US Data Privacy Framework, active (https://fly.io/legal/data-privacy-framework/, as published on 2026-09-06) | A volume and its snapshots are deleted when the volume is destroyed; we reclaim an idle bot computer on our own schedule |
| Resend, Inc. (United States) | eu-west-1, Ireland | Transactional e-mail (sign-in codes, receipts, account notices), bot e-mail (the mail a bot receives at and sends from its own address), and delivery and complaint events | Standard Contractual Clauses | As set out in Resend's own published retention schedule for message bodies and recipient addresses. We keep the record that an account e-mail was sent, never its body, on the schedule in the Privacy policy |
| Stripe Payments Europe, Ltd. (Ireland) | EU | Subscription billing, payment processing and invoicing | Established in the EEA, so no Chapter V transfer arises between us and Stripe; Stripe's own onward transfers run under its Standard Contractual Clauses | As Stripe's terms and financial-records law require |
Language and vision models
Your content is sent to a model provider to produce the answer, and for nothing else. It is not used to train their models, and the provider keeps no prompts or outputs. Every route we run is under a zero-data-retention arrangement with its provider, and the Retention column names it. A provider that cannot offer one is not used on the hosted service. Which provider a call goes to is decided by your organisation's residency setting. Every organisation starts on EU-only routing, and on that setting a call is made only on a route that runs in the EU, or on a route whose transfer runs under the Standard Contractual Clauses (image and music generation, below). Where no such route exists for what was asked, the call is refused, not sent somewhere else.
The routes we run
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Ireland) | Vertex AI, EU multi-region | Google's Gemini models, and the search index we build from your text | Established in the EEA, so no Chapter V transfer arises between us and Google Cloud EMEA. Google's onward transfer to Google LLC in the United States, for maintenance and support, runs under Google LLC's EU–US Data Privacy Framework certification with Standard Contractual Clauses, Module Three, as the fallback (https://cloud.google.com/terms/data-processing-addendum, as published on 2026-09-06) | Zero retention by contract: prompt caching is off for our project and Google has granted the abuse-monitoring logging exception, under the Cloud Data Processing Addendum. Anthropic's Claude models on Vertex AI are not used, because they are logged for up to 30 days. Google will not use customer data to train or fine-tune AI/ML models without the customer's prior permission or instruction (https://cloud.google.com/terms/service-terms, as published on 2026-09-06) |
| Mistral AI (France) | EU | Mistral's own models, the search index we build from your text, and dictation | Established in the EU, so no Chapter V transfer arises | Zero retention by contract: Mistral's zero-data-retention option, granted to our organisation. We add no retention of our own: we send the request, we keep the answer, and we store nothing with Mistral |
Image and music generation, outside the EU under the Standard Contractual Clauses
Since 27 October 2026 these routes are used on EU-only routing too, on their recorded transfer basis, the European Commission's Standard Contractual Clauses. An administrator can exclude Google, or narrow the organisation's model allowlist, and they are then refused.
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Ireland) | Vertex AI, Google's global endpoint, and us-central1 (United States) | Image generation: a picture a bot generates, including a bot's generated avatar. Music generation: a piece of music a bot generates (global endpoint). These routes process your description outside the EU | Standard Contractual Clauses: Google's processing outside the EEA, by Google LLC in the United States, runs under the Standard Contractual Clauses incorporated in the Cloud Data Processing Addendum (https://cloud.google.com/terms/data-processing-addendum, as published on 2026-09-06), alongside Google LLC's EU–US Data Privacy Framework certification | Zero retention by contract: as on the Google Cloud EMEA Limited row above, prompt caching off for our project and the abuse-monitoring logging exception granted, under the Cloud Data Processing Addendum. We keep the generated picture or clip in your organisation's own storage in the EU, and the description only as a hash |
Only after your organisation's owner allows providers outside the EU
Only the owner of an organisation can move it off EU-only routing to the setting that allows providers outside the EU, and has to type the organisation's name to confirm it. An administrator can then add your organisation's own key for a model provider, and calls on that key go to that provider:
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| Anthropic PBC (United States) | United States | Anthropic's Claude models, on your organisation's own Anthropic key. This route processes your content outside the EU | Standard Contractual Clauses | Zero retention by contract: Anthropic's zero-data-retention addendum, on your organisation's own Anthropic account, which is the account the key belongs to. We add no retention of our own: we send the request, we keep the answer, and we store nothing with Anthropic |
We hold no key of our own for Anthropic PBC on the hosted service, so a call reaches it only on a key your organisation entered itself. The same holds for any other provider outside the EU that your organisation adds its own key for. An owner can move the organisation back to EU-only routing at any time, and from then on those routes are refused again.
Each provider's commitment above should be read against its own published terms. The cells that carry a URL and a date were read from the provider's own document on that date; the rest are our description of the arrangement, and we re-read them against the provider's published terms at least once a quarter and whenever a provider announces a change.
Voice calls
A voice call is the other part of the product where processing is not all in the EU, and we say so rather than leaving it out. The recording, the audio and the turn-by-turn transcript are handled by a provider below while a call is running. Everything we keep about the call, the call record, the transcript in our database, and the usage records behind your bill, stays in the same EU database as the rest of your data, under the same separation, the same encryption and the same retention schedule.
Which provider handles a call follows your organisation's voice setting, which an administrator chooses, and its residency setting. An administrator has to acknowledge a provider outside the EU before the first call that would use it, and until they do, those calls are refused. An organisation set to EU-only routing gets a provider in the EU or no call.
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| ElevenLabs (United States) | Global, or the provider's EU residency environment | Speech to text, speech synthesis and turn-taking | Standard Contractual Clauses. Even on the EU residency environment, support and content moderation are named exceptions to the location guarantee | No zero-retention arrangement yet: ElevenLabs grants its zero-retention setting to Enterprise customers only. Until it does so for us, no call or dictation is sent to ElevenLabs on the hosted service |
| Google Cloud EMEA Limited (Ireland) | eu-texttospeech.googleapis.com | Speech synthesis | Established in the EEA, so no Chapter V transfer arises | Zero retention by contract: no logging; processing at rest and in use within Europe, under the Cloud Data Processing Addendum (https://cloud.google.com/terms/service-terms, as published on 2026-09-06) |
| Deepgram, Inc. (United States) | Deepgram's EU endpoint, api.eu.deepgram.com | Speech to text for voice calls: the audio of what a member says to a bot. Interim, until our speech-to-text provider in the EU is live | Interim. Deepgram is established in the United States, so a transfer under Chapter V arises even on its EU endpoint. Deepgram publishes no data processing agreement; ours with Deepgram, and the transfer instrument it names, are being confirmed | No zero-retention arrangement yet: Deepgram's retention terms for audio and transcripts, and whether it offers us zero retention, are being confirmed with Deepgram. Deepgram does not train its models on this audio: every request we send opts out of its model improvement programme (https://developers.deepgram.com/docs/the-deepgram-model-improvement-partnership-program, read on 2026-10-27) |
Voice is part of the product today, which is why this section is on the page. If we add a provider, its row goes on this page and your organisation's administrators are notified before it goes live, the same as for any other sub-processor.
Web search
When a member asks a bot to look something up on the web, the bot writes a search query and sends it to a web search provider, which returns titles, links and short extracts of the pages it found. What reaches the provider is the text of the search query, which the bot writes from the conversation and which can therefore contain whatever the member asked about. Nothing else from your organisation is sent with it: no conversation, no file, no name or address of the member.
Web search does not follow your organisation's residency setting today. A search goes to the provider the service is set up with, whatever that setting is.
| Company we contract with | Where it runs | What it does | Legal instrument | Retention |
|---|---|---|---|---|
| European Perspective SAS (France), the company behind Staan | OVHcloud, France. Staan has a backup in the United States that fills in results only when its own index cannot, and it is on unless the customer asks for it to be switched off. Switching it off for our account is being confirmed with Staan | Web search: the search query a bot sends when a member asks it to search the web | Established in the EU, with EU hosting (OVHcloud, France), so no Chapter V transfer arises. Staan provides its data processing agreement on request; we requested it on 28 October 2026 | Staan's query logs are held by its hosting provider, OVH, in France. Staan states that API search requests are not personal data and that it collects nothing linking a request to a person (https://staan.ai/privacy-policy, as published in June 2026, read on 2026-10-28). How long Staan keeps API query logs is not stated in its published documents and is being confirmed with Staan |
| Brave Software, Inc. (United States) | United States. Brave offers no EU endpoint | Web search: the search query a bot sends when a member asks it to search the web. This route processes the query outside the EU | Brave's data processing addendum, which treats search query data as non-personal and outside its processor terms; the transfer mechanism (Standard Contractual Clauses or EU-U.S. Data Privacy Framework) will be confirmed with Brave before general availability. | No zero-retention arrangement: Brave keeps search query logs for up to 90 days, and offers zero retention on its Enterprise plan only, which we do not have |
Places you connect a bot to
Beyond the sub-processors above, a member of your organisation may connect a bot to a service of their own choosing. Today that is Gmail, and Slack as an inbound channel. That connection, and whatever it shares, is your member's decision and your organisation's responsibility. We have not appointed those companies and they are not our sub-processors. What a connector may reach is limited by the permissions your member grants it.
Changes to this list
When we add a sub-processor, we notify your organisation's administrators and give you 30 days to object before it goes live. The objection route is in the Data processing addendum.
This 30-day notice applies from general availability of Botseon. Changes made before then take effect on the date they are made, with no notice period: the image and music generation routes above were added to this list on 27 October 2026.
On 28 October 2026 we added three sub-processors: the two web search providers above, Staan (European Perspective SAS, France) and Brave Search API (Brave Software, Inc., United States), and Deepgram, Inc. (United States), for speech to text in voice calls. As Botseon is not yet generally available, they took effect on the day they were added, with no notice period.
Contact
Botseon ApS, CVR 46714040, Skansevej 88, 3400 Hillerød, Denmark. Questions about this page: privacy@botseon.com.