Suunta.ai sub-processor list
About this list
This list names the subprocessors that may process Customer Data in the Suunta.ai service. The Customer grants general authorization to engage subprocessors under section 6.1 of our Data Processing Agreement. We give notice before a new subprocessor is taken into use, and Customers may object on reasonable data protection grounds (DPA sections 6.3 and 6.4). Which providers are used for a given feature may vary over time within this list. Our subprocessors' own subprocessors are shown in the lists they maintain, which we link to under Subprocessors' own lists.
Infrastructure and hosting
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, email delivery and related infrastructure services | EU | Data in the EU; for support, Data Privacy Framework (DPF) and Standard Contractual Clauses |
Data Privacy Framework (EU-U.S.) certifications were checked against the U.S. Department of Commerce list on 12 October 2026.
AI processing
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Anthropic | AI processing, web search and AI tools used in customer support | USA | Standard Contractual Clauses |
| OpenAI | AI processing, document search, web search and abuse screening of content | EU | Data in the EU; transfers by OpenAI Ireland Ltd to group companies under Standard Contractual Clauses |
| AI processing and web search | USA | Data Privacy Framework (DPF) and Standard Contractual Clauses | |
| Mistral AI | AI processing | EU/USA | Standard Contractual Clauses |
AI providers receive the prompt and the context needed to produce a response. We select providers and their settings so that Customer Data is not used to train the providers' general-purpose models (DPA section 5.3). The providers' material retention practices are described below. The information was checked against the providers' terms on 11 October 2026, and we check it at least once a year and whenever a provider or its terms change.
| Provider | Retention | Source |
|---|---|---|
| Anthropic | Inputs and outputs are deleted within 30 days. Longer only where enforcement of the usage policy or the law requires it. | https://privacy.claude.com/en/articles/7996866 |
| OpenAI | Zero data retention is in use: text inputs and outputs are not retained. Image and file inputs may be retained for abuse monitoring, and images identified as child sexual abuse material are retained for review and reporting. | https://developers.openai.com/api/docs/guides/your-data |
| On the paid tier, prompts and responses are logged for a limited period solely to detect prohibited use and for legal obligations. They are not used to improve Google products. | https://ai.google.dev/gemini-api/terms | |
| Mistral AI | Inputs and outputs are retained for up to 30 days for abuse monitoring. | https://legal.mistral.ai/terms/data-processing-addendum |
Product analytics
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| PostHog | Product usage analytics, with consent | EU/USA | Data Privacy Framework (DPF) and Standard Contractual Clauses |
Integration infrastructure
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Nango | Connection handling for certain third-party integrations the Customer enables | USA | Data Privacy Framework (DPF) and Standard Contractual Clauses |
Payments and billing
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Stripe | Payment processing | USA/EU | Data Privacy Framework (DPF) and Standard Contractual Clauses |
Communications
| Subprocessor | Purpose | Location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Resend | Service-related email | USA/EU | Data Privacy Framework (DPF) and Standard Contractual Clauses |
Customer-initiated integrations
When the Customer connects a third-party system (for example Slack, Microsoft Teams, Microsoft 365, Google Workspace, HubSpot, Salesforce, Notion or GitHub), data is exchanged with that system within the access the Customer grants. The provider of that system processes the data under its own terms with the Customer.
Possible future services
We may introduce services for bot and abuse protection on sign-up forms and for our own customer relationship management. They are added to this list before they are taken into use.
Subprocessors' own lists
Our subprocessors publish their own subprocessors in the following lists. The links are checked whenever this list is updated. If a link does not work or a subprocessor does not publish its own list, we provide the information on request.
| Subprocessor | List |
|---|---|
| Amazon Web Services (AWS) | https://aws.amazon.com/compliance/sub-processors/ |
| Anthropic | https://www.anthropic.com/subprocessors |
| OpenAI | https://openai.com/policies/sub-processor-list/ |
| https://business.safety.google/subprocessors/ | |
| Mistral AI | https://trust.mistral.ai |
| PostHog | https://posthog.com/subprocessors |
| Nango | https://nango.dev/subprocessors |
| Stripe | https://stripe.com/legal/service-providers |
| Resend | https://resend.com/security/gdpr |
Contact
For subprocessor inquiries: privacy@suunta.ai