AI Partner
Trust centre

Vendor information

Our sub-processors

AI Partner engages a small number of third-party entities to perform limited activities in connection with our services. The table below shows what each entity does, the data it is authorised to process, and where that processing takes place.

Registry last updated .

Third-party sub-processors

Each entity is authorised only for the processing described. None of them receive customer data beyond what that activity requires.

  • Google Cloud Platform (Google Ireland Limited)

    Application hosting (Cloud Run), managed PostgreSQL (Cloud SQL), encrypted object storage for brief attachments (Cloud Storage), secret management, and container builds. Processes all customer and partner data at rest.

    Location
    European Union (Belgium)
    Certifications
    ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3
    Since
    2026-08-25

  • Google Workspace (Google Ireland Limited)

    Transactional email delivery over SMTP: notifications, workspace invitations, email verification and password resets. Processes recipient name, email address and message contents.

    Location
    European Union
    Certifications
    ISO/IEC 27001, ISO/IEC 27701, SOC 2, SOC 3
    Since
    2026-08-25

  • Google Calendar & Google Meet (Google Ireland Limited)

    Scheduling scoping calls and hosting the video meeting. Processes attendee email addresses, meeting titles and agendas, and free/busy availability of the AI Partner host calendar.

    Location
    European Union
    Certifications
    ISO/IEC 27001, ISO/IEC 27701, SOC 2, SOC 3
    Since
    2026-08-25

  • Groq, Inc.

    Large language model inference that drafts structured briefs from customer answers, extracts briefs from call transcripts, extracts partner profiles from public pages, and anonymises partner proposals before comparison. Processes brief content, uploaded document text and call transcripts. Inference inputs and outputs are not retained by default; where retained for reliability or abuse investigation the period is up to 30 days. Processed in the United States under Standard Contractual Clauses.

    Location
    United States
    Certifications
    SOC 2
    Since
    2026-08-31

A machine-readable version of this registry is published at /api/v1/sub-processors— useful for automated vendor monitoring.

How we manage sub-processors

Contractual safeguards

Every sub-processor is bound by a data processing agreement carrying GDPR Art. 28 obligations, including confidentiality, security measures, and assistance with data subject requests.

Change notice

We give 30 days' notice before a new sub-processor starts processing customer data, so you have time to review and object before the change takes effect.

International transfers

Where processing happens outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest.

Questions about a sub-processor?

Read our data processing addendum, ask about a specific vendor, or object to a planned change. Our privacy team responds within one business day.

Read the DPAprivacy@aipartner.cloud