Trust Center

Subprocessor List

Last updated: 8 September 2026

1. Introduction

1.1. Scope

This Subprocessor List identifies third parties that ASUME B.V. (“ASUME,” “we,” “us,” or “our”) may engage to Process Processor Personal Data on behalf of Customers in connection with the Service (“Subprocessors”). This list applies only where ASUME acts as a Processor under the Data Processing Agreement (“DPA”).

1.2. Other Service Providers

ASUME also uses third-party providers that do not Process Processor Personal Data on behalf of Customers. This includes providers that Process Personal Data for purposes for which ASUME acts as an independent Controller and providers that do not Process Personal Data. Such providers are not Subprocessors merely because ASUME uses their services and are not necessarily included in this list.

1.3. Processing Locations

Processing locations identified below describe the locations applicable to ASUME's use of the relevant Subprocessor or the locations through which the relevant provider may Process Processor Personal Data. Some providers operate distributed infrastructure or use their own subprocessors in additional jurisdictions. Where ASUME selects a particular hosting or data-residency region, the selected region determines the primary location of the relevant Customer workload, subject to any ancillary Processing permitted under the applicable provider agreement.

1.4. International Transfers

Where Processor Personal Data is transferred from the European Economic Area to a country that is not covered by an applicable adequacy decision, ASUME requires an appropriate transfer mechanism in accordance with the DPA and Applicable Data Protection Law. The safeguards identified below may include the European Commission Standard Contractual Clauses (“SCCs”), an applicable adequacy decision such as participation in the EU-U.S. Data Privacy Framework (“DPF”), and supplementary measures where appropriate.

1.5. Defined Terms

Capitalised terms not defined in this Subprocessor List have the meanings given in the DPA or applicable Agreement.

2. Current Subprocessors

2.1. Authorisation

Customer generally authorises ASUME to engage the Subprocessors identified below in accordance with the DPA. A Subprocessor may Process Processor Personal Data only to the extent reasonably necessary for the applicable Service functionality and subject to the contractual and data-protection safeguards applicable to that Subprocessor.

2.2. Feature-Dependent Processing

Some Subprocessors are used only in connection with particular AI models, infrastructure, integrations, features, regions, or Customer configurations. Inclusion of a provider in this list does not mean that the provider Processes Processor Personal Data relating to every Customer.

Subprocessor	Service / Purpose	Applies When	Processing Location	Transfer Safeguard
OpenAI Ireland Ltd.	AI model inference and related AI processing	Customer uses Service functionality routed to OpenAI models or services	Ireland; onward Processing may occur in the United States and other locations used by authorised OpenAI affiliates and subprocessors	EEA Processing through OpenAI Ireland Ltd.; adequacy decision or SCCs for applicable onward transfers outside the EEA
Anthropic Ireland, Limited	AI model inference and related AI processing	Customer uses Service functionality routed to Anthropic models or services	Processing may occur in the United States, Europe, Asia and Australia; Anthropic states that commercial Customer Data storage is in the United States by default	SCCs incorporated into Anthropic's commercial DPA and other applicable lawful transfer mechanisms
Amazon Web Services EMEA SARL	Cloud infrastructure, computing, storage and hosting	Processor Personal Data is hosted or Processed through ASUME's AWS infrastructure	United States for the ASUME workloads currently designated to US AWS infrastructure; AWS otherwise Processes Customer Data primarily in the Customer-selected AWS region	EU-U.S. DPF where applicable; SCCs automatically incorporated into the AWS DPA for restricted transfers; supplementary safeguards where appropriate
Hetzner Online GmbH	Cloud infrastructure, computing and hosting	Processor Personal Data is hosted or Processed through ASUME workloads deployed on Hetzner	Germany for the ASUME workloads using Hetzner	EEA Processing; no Chapter V GDPR transfer mechanism required for Processing remaining in Germany/EEA. Hetzner's DPA and SCC arrangements apply where a third-country Hetzner location is used.
Databricks, Inc. (Neon)	Managed PostgreSQL database infrastructure	Processor Personal Data is stored in or Processed through the Neon database service	United States for the ASUME Neon deployment currently designated to US infrastructure	EU-U.S. DPF where applicable; SCCs apply where the DPF does not apply or another appropriate safeguard is required
Supabase, Inc.	Managed PostgreSQL database, authentication, storage and related backend services	Processor Personal Data is stored in or Processed through ASUME's Supabase project	European project region selected by ASUME; Supabase stores primary project data in the selected project region	SCCs incorporated into the Supabase DPA for applicable restricted transfers; no additional Chapter V mechanism is required to the extent Processing remains entirely within the EEA
Vercel Inc.	Application hosting, deployment, edge delivery and server-side application infrastructure	Processor Personal Data passes through Vercel-hosted ASUME application or server-side functionality	United States and Vercel's global network; Vercel functions are US-based by default unless another region is configured	SCCs under the Vercel DPA for applicable EEA restricted transfers and other applicable transfer mechanisms
Raintank, Inc. dba Grafana Labs	Application observability, logs, traces and metrics	ASUME telemetry sent to Grafana may contain Processor Personal Data	United States for ASUME's currently designated Grafana processing; Grafana offers additional regions including EU regions	EU-U.S. DPF where applicable; SCCs and other transfer safeguards under Grafana's DPA for applicable restricted transfers

3. Data Minimisation

3.1. Limited Disclosure

ASUME seeks to limit Processor Personal Data made available to each Subprocessor to the information reasonably necessary for the relevant Service functionality. Inclusion of a Subprocessor in this list does not mean that the Subprocessor has access to all Customer Data, all Processor Personal Data, or all information maintained by ASUME.

3.2. AI Providers

Where an AI model provider is used as a Subprocessor, information provided to that provider is limited to the prompts, context, instructions, Inputs, Outputs, or other information reasonably necessary to perform the relevant model request. ASUME's use of Customer Data for model Training is separately governed by the Agreement and DPA.

3.3. Observability Providers

ASUME seeks to minimise the inclusion of Customer content in logs, traces, metrics, diagnostics, and similar observability information. Where such information contains Processor Personal Data, it remains subject to the DPA.

4. Changes to Subprocessors

4.1. Updates

ASUME may update this Subprocessor List as the Service, infrastructure, providers, features, and Processing arrangements change.

4.2. Prior Notice

ASUME will provide at least thirty (30) calendar days' prior notice before authorising a new material Subprocessor to Process Processor Personal Data, in accordance with the DPA. Notice may be provided by email, through the Service, through a Subprocessor-update subscription mechanism, or by another reasonable method.

4.3. Urgent Changes

Where an urgent Subprocessor appointment is reasonably necessary to address a security incident, provider failure, service disruption, legal requirement, emergency, or comparable circumstance, ASUME may appoint the Subprocessor before expiry of the ordinary notice period and will provide notice without undue delay.

4.4. Objections

Customer may object to a new material Subprocessor during the applicable notice period only on reasonable and documented data-protection grounds. The objection procedure and remedies are governed by the DPA.

5. Subprocessor Notifications

5.1. Notifications

Customers may request notifications concerning additions or replacements of material Subprocessors by contacting ASUME at privacy@asume.ai or through any Subprocessor-notification functionality made available by ASUME.

5.2. Administrative Contacts

ASUME may send Subprocessor notices to the Workspace administrator, privacy contact, contractual contact, or other Customer contact identified in the applicable Account or Order Form. Customer is responsible for keeping those contact details current.

6. Contacting Us

Questions regarding this Subprocessor List, Processing locations, international transfer safeguards, or proposed changes to Subprocessors may be sent to:

privacy@asume.ai

Full ASUME B.V. company details are available in our Legal Notice.