Every third party that may process customer data on our behalf, with its purpose, location and transfer mechanism.
These sub-processors run the Standard Compute service for every customer.
| Sub-processor | Purpose | Data | Location | Transfer |
|---|---|---|---|---|
| Google Cloud EMEA Limited | Gateway hosting, dashboard hosting, operational logging | Request content in transit; request metadata; account data | Finland, Netherlands (EU); United States for the optional US gateway only | EEA |
| Supabase, Inc. | Database and authentication | Account data; request metadata | Frankfurt, Germany (AWS eu-central-1) | SCCs |
| Cloudflare, Inc. | DNS, TLS termination, DDoS protection | Request content in transit | Global edge, nearest data centre | SCCs, DPF |
| OpenRouter, Inc. | Routing intermediary to inference providers, for workspaces without a region rule | Request content in transit | Worldwide. Not used for workspaces restricted to Europe | SCCs |
| Stripe Payments Europe, Ltd. | Payments and invoicing | Billing contact, payment details | Ireland (EU) | EEA |
| Resend | Transactional email | Name, email address | United States | SCCs |
Inference providers receive prompt and response content for the duration of a request. They are the only sub-processors whose use depends on your settings. Your company administrator decides which of them may handle your data with the provider allow-list. Providers not on your list never receive your requests, including retries and fallbacks.
Approved for workspaces restricted to Europe
| Provider | Service | Processing location |
|---|---|---|
| Microsoft Ireland Operations Ltd | Azure AI model hosting | EU regions incl. Sweden Central |
| Google Cloud EMEA Limited | Vertex AI model hosting | EU regions |
| Amazon Web Services EMEA SARL | Amazon Bedrock model hosting | Ireland (eu-west-1) |
| Mistral AI SAS | Mistral models | EU |
| TensorX Ltd | Open-weight model hosting | Dublin, Ireland; Helsinki, Finland |
| Inceptron AB | Open-weight model hosting | EU/EEA |
Every endpoint above meets our Provider Requirements: no training on customer data, zero data retention, and a documented processing location. All are within the EEA, so no transfer mechanism is required.
Workspaces without a region rule
Workspaces without a region rule may also be served by other providers, including providers outside Europe. The current list is shown in the provider directory in the dashboard and is available on request.
For workspaces without a region rule, most inference requests pass through OpenRouter, which connects us to a wide range of providers worldwide. OpenRouter does not choose the provider. Our gateway sets the permitted endpoints on each request.
For workspaces restricted to Europe, OpenRouter is not used. Our gateway, which runs in the EU, connects directly to the European providers listed above, so request content stays in Europe for the full path.
We give at least 14 days' written notice before adding or replacing a sub-processor that processes customer data.
Customers may object on reasonable data protection grounds within that period. We will then work in good faith on an alternative, such as excluding the sub-processor from the customer's allow-list.
A new inference provider never joins an existing provider allow-list automatically. An administrator must approve it.
To receive notices, email contact@standardcompute.com with the subject "Sub-processor notifications".
SCCs: EU Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved. DPF: EU-US Data Privacy Framework. EEA: processing within the European Economic Area, no transfer mechanism required.