Sub-processor Registry
Sub-processors engaged by Neuravant AI Limited to support delivery of the NAIL platform. We notify customers at least 30 days before any addition or replacement. Customers may object under Art. 28(2) GDPR by writing to legal@neuravant.ai.
| Sub-processor | Purpose | Location of Processing | Transfer Mechanism |
|---|---|---|---|
| Google Cloud Google Ireland Ltd. — Dublin, IE |
Core infrastructure: Cloud Run, Cloud SQL, Cloud Storage, Cloud KMS | europe-west2 (London, UK) |
UK processing; EU→UK flows covered by the EU adequacy decision for the UK |
| Google Cloud — GPU derivation service | Model-evidence derivation. Processes a tenant-independent seed corpus only — no customer personal data | europe-west1 (Belgium) |
Intra-EEA |
| Firebase Authentication (Google) | Single sign-on (Google / Microsoft) identity data | Google infrastructure (separate Google Cloud project) | Google Cloud Data Processing Addendum; SCCs where applicable |
| Google AI — Gemini API | LLM judge for audit scoring: audit prompts and agent responses are evaluated by the Gemini API | Google infrastructure | Google API Data Processing terms; SCCs where applicable |
| Cloudflare, Inc. | CDN, DDoS protection, edge caching, static hosting (Cloudflare Pages) | Global edge network | EU Commission SCCs (2021/914); UK IDTA Addendum; DPF certified |
| Stripe Payments Europe Ltd. | Payment processing, subscription billing | Ireland (primary), USA (failover) | EU Commission SCCs; DPF certified |
| Microsoft 365 (Microsoft Ireland Operations Ltd.) | Company mailboxes — customer correspondence | EU/UK datacentre regions | Microsoft Products and Services DPA; SCCs |
| Twilio SendGrid | Transactional email (verification, notifications) | Ireland (primary), USA (failover) | EU Commission SCCs; DPF certified |
| SMTP relay provider | Outbound operational email where SendGrid is not used | EU | Provider DPA |
| Knock Labs, Inc. | Incident notification orchestration (delivery status webhooks) | USA | EU Commission SCCs |
| PagerDuty, Inc. | Operational alerting for the on-call engineer | USA | EU Commission SCCs; DPF certified |
| Amazon Web Services (S3) | Encrypted code-repository backups — no customer personal data | eu-west-2 (London, UK) |
No personal data transferred |
Change history
- April 2026 — v1.0: Initial publication.
- 2 September 2026 — v2.0: Corrected to the providers actually in use: added Firebase Authentication, Google AI (Gemini), the Belgium GPU derivation service, Microsoft 365, SMTP relay, Knock, PagerDuty and AWS S3; removed Sentry, Plausible, Hugging Face and 1Password (not in use); corrected region to London
europe-west2.
Notifications
Subscribe to sub-processor change notifications by emailing legal@neuravant.ai with subject line "Subscribe sub-processor notifications".
Version 2.0 · 2 September 2026