top of page
Sub-Processors
Oiva AI Solutions Oy ("Oiva") uses the following sub-processors to provide our services.
Per Section 6 of the Data Processing Addendum, Oiva notifies customers at least 10 days in advance when a new sub-processor is added that processes Customer Personal Data in a new category. Changes required for security, legal compliance, or service continuity are reflected on this page as soon as reasonably practicable.
Infrastructure and Hosting
Sub-processors | Purpose | Data Location | Transfer Basis | Notes |
|---|---|---|---|---|
Cloudflare, Inc. | Application hosting, CDN, WAF, DDoS protection | Global Edge | EU SCCs | Processing occurs at the Cloudflare edge node closest to the requesting user (both End Users and Authorized Users). |
Supabase, Inc. | Database storage and authentication | EU - Ireland | EU SCCs | EU project region; US-incorporated processor - SCCs apply via Supabase DPA |
AI / Large Language Model Providers
Sub-processors | Purpose | Data Location | Transfer Basis | Notes |
|---|---|---|---|---|
OpenAI, L.L.C. | LLM inference (accessed via Vercel AI Gateway) | United States | EU SCCs | OpenAI API (not ChatGPT consumer). Inputs and outputs are not used to train OpenAI models per the OpenAI API data usage policy. |
Vercel Inc. | AI Gateway — multi-provider LLM routing | United States | EU SCCs | Routes LLM API calls to downstream providers. Data handling governed by the [Vercel DPA](https://vercel.com/legal/dpa). |
Identity and Communications
Sub-processors | Purpose | Data Location | Transfer Basis | Notes |
|---|---|---|---|---|
ActiveCampaign, LLC (Postmark) | Transactional email to tenant administrators | United States | EU SCCs | |
Twilio Inc. (SendGrid) | Transactional email to End Users | United States | EU SCCs | |
Microsoft Ireland Operations Limited (Microsoft Entra ID) | Optional identity provider for Authorized User SSO, used only when the Customer's Authorized Users sign in via their organization's Entra tenant. | EU (with limited support access from outside EU under Microsoft DPA) | EU SCCs (Microsoft Products and Services DPA) | Processes only Authorized User authentication metadata; no access to End User or Customer Personal Data |
Monitoring and Operations
Sub-processors | Purpose | Data Location | Transfer Basis | Notes |
|---|---|---|---|---|
Langfuse GmbH | LLM observability — tracing and evaluation (Langfuse Cloud) | EU — Germany | None required (intra-EEA) | EU cloud deployment. Receives prompts and completions including any conversation content; used for tracing and evaluation only, not for model training. |
Functional Software, Inc. d/b/a Sentry | Application error and performance monitoring | EU — Frankfurt | EU SCCs | EU data residency selected; US-incorporated processor — SCCs apply via Sentry DPA |
bottom of page