Security & Supply Chain
Sub-processors Directory
Transparent disclosure of third-party vendors and infrastructure providers engaged by Dotnitron to process customer data and deliver enterprise AI systems.
1. Sub-processor Governance Policy
Under our Data Processing Addendum (DPA) and Supplier Security Policy, Dotnitron maintains strict oversight over all third-party service providers. Before onboarding any sub-processor handling customer data:
- Security Due Diligence: We verify independent security certifications (SOC 2 Type II, ISO 27001), encryption standards, and vulnerability management postures.
- Zero-Training Verification: For AI and model providers, we contractually verify that customer inputs, prompts, and outputs are never used to train base foundation models.
- Contractual Safeguards: Sub-processors are bound by written agreements providing data protection standards equivalent to our client DPA, including EU Standard Contractual Clauses (SCCs) and UK IDTA where applicable.
- Customer Isolation & BYOK: In private VPC or on-premise deployments, clients can substitute sub-processors with their own accounts (BYOK / BYOA) or self-hosted alternatives.
2. Active Sub-processor List
Last updated: November 2026. The specific sub-processors utilized for a client depend on the chosen deployment architecture (Client VPC vs. Hosted SaaS) and selected features.
AI & Model Providers
| Sub-processor | Service & Purpose | Data Processed | Processing Location | Transfer Safeguard |
|---|---|---|---|---|
| Microsoft Corporation (Azure OpenAI & Document Intelligence) | Enterprise LLM inference, embedding generation, OCR and layout extraction | Customer document excerpts, prompts, completions (ephemeral inference; zero model training) | United States, European Union, or Customer-designated Azure Region | EU Standard Contractual Clauses (SCCs), Microsoft Data Protection Addendum (DPA) |
| OpenAI, LLC | Commercial API model inference and vector embedding services | Text prompts, completions, and document chunks (zero model training under API Business Terms) | United States | EU Standard Contractual Clauses (SCCs), OpenAI Business DPA |
| Anthropic, PBC | Claude foundation model inference via commercial API | Text prompts and completions (zero model training on commercial API traffic) | United States | EU Standard Contractual Clauses (SCCs), Anthropic Commercial Terms |
| Google LLC (Google Cloud / Vertex AI) | Enterprise Gemini model inference and multimodal processing | Customer text and document inputs (zero foundation model training without consent) | United States, European Union, or Customer GCP Region | EU Standard Contractual Clauses (SCCs), Google Cloud Data Processing Addendum |
| AssemblyAI, Inc. | Optional speech-to-text audio transcription | Audio recordings and generated text transcripts (zero model training on commercial API) | United States | EU Standard Contractual Clauses (SCCs), AssemblyAI DPA |
| DeepInfra Inc. | Specialized open-weights model inference endpoints | Inference queries and text completions | United States | Commercial Terms of Service & Data Protection Safeguards |
Cloud Infrastructure & Storage
| Sub-processor | Service & Purpose | Data Processed | Processing Location | Transfer Safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud hosting, S3 encrypted object storage, parameter secrets, and transactional email (SES) | Encrypted customer files, application databases, workspace archives, and audit records | India (ap-south-1), United States, European Union, or Customer VPC | AWS GDPR Data Processing Addendum, EU Standard Contractual Clauses (SCCs) |
| Microsoft Corporation (Azure Cloud) | Cloud virtual machines, isolated code execution sandbox, and Blob storage | Application workloads, sandboxed analysis containers, and encrypted backups | United States, European Union, India, or Customer Azure Subscription | Microsoft Products and Services DPA, EU Standard Contractual Clauses |
| Qdrant Solutions GmbH | High-performance vector database for semantic search and retrieval | High-dimensional vector embeddings and document chunk metadata | Germany / European Union (or Customer Self-Hosted Cluster) | EU GDPR Direct Compliance (Germany), EU SCCs |
Operations & Website
| Sub-processor | Service & Purpose | Data Processed | Processing Location | Transfer Safeguard |
|---|---|---|---|---|
| Vercel Inc. | Edge CDN hosting, edge proxy middleware, and aggregate web telemetry | Public website HTTP request headers, IP address (ephemeral), aggregate metrics | Global Edge Network / United States | EU Standard Contractual Clauses (SCCs), Vercel DPA |
| Formspree Inc. | Website contact form routing and dispatch | Public inquiry details (name, email, company, inquiry message) | United States | EU Standard Contractual Clauses (SCCs), Formspree Privacy Terms |
| PostHog, Inc. | Optional, consented product usage analytics (disabled by default) | Pseudonymous telemetry events (no customer document content or personal credentials) | United States / European Union | EU Standard Contractual Clauses (SCCs), PostHog DPA |
3. Subscribe to Sub-processor Change Notifications
Under our DPA, enterprise clients receive at least 30 days advance notice before any new sub-processor is added. To register your security or compliance team for email notifications:
Sub-processor Notification Service
Email: privacy@dotnitron.com (or info@dotnitron.com)
Subject line: [Sub-processor Subscription Request]. Please include your company name and authorized compliance contact.