This page lists the third parties AIW may engage to process personal data on behalf of clients, as referenced in §5 of the Data Processing Agreement. Not every sub-processor is used in every engagement; the applicable set is recorded in Annex 3 of each client's DPA.
Studio Infrastructure
| Sub-processor | Role | Processing location | Transfer mechanism |
|---|---|---|---|
| Cloudflare | Application hosting, edge delivery, DDoS mitigation | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
| Hostinger Mail | Business email, calendar, document storage | EEA (preferred) — otherwise as stated in Annex 3 | EEA, adequacy decision, or EU Standard Contractual Clauses |
| Managed cloud database & object storage provider | Managed database and object storage | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
| Privacy-conscious, cookieless analytics (only where configured) | Aggregate website analytics | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
| Application error monitoring provider | Application error and performance monitoring | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
AI And Model Providers
Engaged only where a Deliverable requires inference. Configured, where the provider offers it, to exclude client content from provider model training and to apply zero or minimal retention.
| Sub-processor | Role | Processing location | Transfer mechanism |
|---|---|---|---|
| OpenAI | Foundation model inference | EEA (preferred) — otherwise as stated in Annex 3 | Adequacy decision or EU Standard Contractual Clauses |
| Anthropic / Google | Foundation model inference, embeddings | EEA (preferred) — otherwise as stated in Annex 3 | Adequacy decision or EU Standard Contractual Clauses |
| Managed vector index provider | Retrieval index for document intelligence | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
| Speech-to-text provider | Audio transcription, where in scope | EEA (preferred) — otherwise as stated in Annex 3 | EEA, or EU Standard Contractual Clauses |
Client-Directed Integrations
Systems the client already operates and instructs AIW to connect to — CRM, ERP, ticketing, telephony, accounting, messaging — are not AIW sub-processors. The client remains responsible for its own relationship and agreements with those providers. AIW documents each integration in the statement of work.
Business Administration
| Sub-processor | Role | Processing location |
|---|---|---|
| Dutch bookkeeping provider | Invoicing and financial records | Netherlands |
| Netherlands-established bank / payment provider | Payment processing | EEA (preferred) — otherwise as stated in Annex 3 |
| E-signature provider | Contract signature | EEA (preferred) — otherwise as stated in Annex 3 |
These support AIW's own controller-side administration rather than client system processing, and are listed for transparency.
Changes
AIW gives clients at least 14 days' notice before a new or replacement sub-processor begins processing their data, by email to the contact named in the Engagement and by update to this page. Objection rights are set out in DPA §5.3.
To receive change notifications for this page, write to admin@agentsiw.com.