Introduction
Under Article 28(4) GDPR, Custos AI publishes all entities engaged to process personal data on behalf of its customers. This page lists all current sub-processors, their purpose, and data location.
Our commitment
We notify all customers at least 30 days before adding or replacing any sub-processor. Customers may object to new sub-processors by contacting . Unresolved objections entitle the customer to terminate the relevant services without penalty.
Current sub-processors
| Sub-processor | Purpose | Location | Entity | Data processed |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | Frankfurt, Germany | Supabase Inc. | Account data, chat history, uploaded files |
| TransIP B.V. | VPS hosting for LiteLLM proxy and budget enforcement | Amsterdam, Netherlands | TransIP B.V. | API request routing, budget metadata |
| Vercel, Inc. | Frontend hosting, edge compute, anonymised analytics | EU edge network | Vercel, Inc. | HTTP requests, anonymised page views |
| Lettermint | Transactional email delivery (invites, alerts, password reset) | EU | Lettermint | Email addresses, message content |
| Stripe Payments Europe, Ltd. | Payment processing and Stripe Tax | Dublin, Ireland | Stripe Payments Europe, Ltd. | Billing data, VAT numbers, transaction references |
LLM providers are not sub-processors
Under our Bring Your Own Key (BYOK) model, each Custos customer maintains a direct contractual relationship with the LLM provider(s) they choose to use — OpenAI, Anthropic, Google, or Mistral. These providers are independent controllers or processors engaged directly by the customer, not Custos sub-processors.
Custos AI acts solely as a technical conduit transmitting the customer's requests to the provider's API using the customer's own API key. The customer is responsible for concluding appropriate data processing agreements with their chosen LLM providers.
Change notifications
When we intend to add or replace a sub-processor, we notify all active customers by email at least 30 days in advance. A log of sub-processor changes is maintained in our changelog at custosai.eu/changelog.
Contact
For questions about sub-processors or data transfers:
Alpha Digital B.V., trading as Custos AI
Stationsplein 26, 6512 AB Nijmegen, The Netherlands
Email:
Our privacy team responds within 2 business days.