List of sub-processors
1. Current sub-processors
This list forms an annex to the Data Processing Agreement and names the entities the Operator engages to process personal data in connection with providing the Service. It covers both data for which the Operator is a controller and data entrusted to it by the Client.
| Entity | Role | Location | Transfer basis |
|---|---|---|---|
| H88 S.A. (cyberFolks) | hosting of the application server and database | Poland | processing within the EEA — no basis required |
| Cloudflare, Inc. | reverse proxy, web application firewall, DNS, and backup storage (R2) | United States / global | standard contractual clauses and the EU–US Data Privacy Framework |
| OpenRouter, Inc. | gateway to language models — transmitting request content and receiving responses | United States | standard contractual clauses |
| Resend, Inc. | transactional email (address verification, password resets, notifications) | United States | standard contractual clauses and the EU–US Data Privacy Framework |
| Brave Software, Inc. | Brave Search API — source discovery in the portal research module | United States | standard contractual clauses |
Standard contractual clauses means the clauses adopted by Commission Implementing Decision (EU) 2021/914. The EU–US Data Privacy Framework means Commission Implementing Decision (EU) 2023/1795 finding an adequate level of protection of personal data for participating entities in the United States.
2. The Operator’s own infrastructure
The services below run on infrastructure administered by the Operator and located in Poland. They are not sub-processors — the Operator does not entrust processing to them but processes the data itself using them. They are disclosed because they mark additional places in which data is stored.
| Service | Role | Location |
|---|---|---|
| LiteLLM | proxy mediating calls to language models — the content of requests and responses passes through it | Poland |
| Langfuse | recording of language model calls for diagnostics and cost control | Poland |
| Umami | site traffic analytics, activated only after consent to the analytics category | Poland |
| Bugsink | application error reporting, with no collection of personal data | Poland |
3. Base model providers
Requests to language models are routed exclusively through the OpenRouter gateway listed among the current sub-processors. OpenRouter forwards them to the providers of the base models. The models used in the Service and the providers to which that forwarding leads are:
| Model | Base model provider | Provider’s registered office |
|---|---|---|
| mistral-nemo | Mistral AI SAS | France |
| deepseek-v4-flash | DeepSeek | People’s Republic of China |
| text-embedding-3-small, gpt-4o-mini | OpenAI, L.L.C. | United States |
The Operator has no separate contracts with the providers of the base models; the basis for the transfer remains the data processing agreement concluded with OpenRouter, which is answerable to the Operator for that onward engagement. The table states the providers’ registered offices because the Operator holds no confirmation of the locations in which those providers physically process the data forwarded to them.
4. Notice of changes
The Operator gives the Client at least 30 days’ notice before adding a sub-processor or replacing an existing one — by a message sent to the email address associated with the Account and by updating this list. Within 30 days of the notice the Client may raise a reasoned objection; the effects of an objection, including the right to terminate the agreement free of charge, are set out in the section “Sub-processors” of the Data Processing Agreement.
Every change to the list is recorded in the section “Change history” together with the date and the version number of this document.
5. Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-09-15 | First publication of the list of sub-processors. |
The history covers changes made from the date of first publication. Entries remain in the table after a sub-processor is withdrawn, so that it stays possible to establish who processed the data and during what period.