Sub-processors
Last updated: 17 August 2026
This is the complete list of Sub-processors engaged by Vallor to Process Customer Personal Data. It is incorporated by reference into the Vallor AI Customer Data Processing Addendum and is the list Vallor makes available to Customers under Section 6.2 of that Addendum. Vallor notifies Customers of changes under Section 6.2, and Customers may object to a new Sub-processor under Section 6.3.
To object to a new Sub-processor, contact admin@vallor.ai.
1. Processing locations
Processing location is determined by the data region assigned to the Customer's organization. Customers assigned to the EU data region are Processed in the locations shown under "EU tenant"; all other Customers under "Non-EU tenant".
2. Infrastructure and platform Sub-processors
| Sub-processor | Purpose | EU tenant | Non-EU tenant |
|---|---|---|---|
| Amazon Web Services, Inc. | Compute, object storage, CDN, API gateway, serverless functions, queues, audit logging | eu-west-1 (replica eu-central-1) | us-east-1 (replica us-west-2) |
| PlanetScale, Inc. | Primary application database, replication, daily backups | aws-eu-west-1 | aws-us-east-1 |
| Google Cloud Platform (Google LLC) | Document AI OCR / parsing; ingestion pipeline storage and functions | europe-west1 (Document AI eu) | us-east1 (Document AI us) |
| API Hero Ltd (t/a Trigger.dev) | Background job orchestration and execution, AI agent workflows | eu-central-1 | us-east-1 |
| WorkOS, Inc. | Authentication, SSO, directory sync | EU | US |
| Functional Software, Inc. (Sentry) | Error monitoring and performance telemetry | EU region | US region |
| PostHog, Inc. | Product analytics telemetry | EU cloud | US cloud |
For Customers in the EU data region, the disaster-recovery replica remains within the European Economic Area.
3. AI model inference Sub-processors
Sub-processors in this section perform model inference and are not region-pinned. Personal Data transferred to them is protected by the Standard Contractual Clauses and by contractual no-training and limited-retention commitments in each provider's data processing agreement, rather than by processing location. See Sections 12.1 and 12.2 of the Data Processing Addendum.
| Sub-processor | Purpose | Location | No-training |
|---|---|---|---|
| Vercel, Inc. (AI Gateway) | Request routing for model inference | Global | N/A (routing) |
| OpenRouter, Inc. | Request routing and failover for model inference | Global | N/A (routing) |
| OpenAI, LLC | Contract analysis, redlining, titles, embeddings, audio transcription | Global | Yes |
| Anthropic, PBC | Chat, reasoning, classification, contract analysis and review | Global | Yes |
| Google LLC (Gemini) | Extraction, summarization, prompt optimization, quick responses | Global | Yes |
| Mistral AI SAS (France) | PDF and image OCR | Global | Yes |
| Cohere Inc. (Canada) | Search result reranking | Global | Yes |
| Unstructured Technologies, Inc. | Document parsing | Global | Yes |
| Exa Labs, Inc. | Web search — search queries only, no Customer Personal Data | Global | N/A |
Mistral AI SAS is established in France and Cohere Inc. in Canada, which benefits from a European Commission adequacy decision. The remaining providers in this section are established in the United States.
Per-provider data categories, retention terms, transfer mechanisms, routing paths, and the no-training attestation are set out in the Vallor Sub-processor Register, available to Customers on request.
4. Why AI model inference is not region-pinned
Model requests are addressed by model identifier through Vercel AI Gateway and OpenRouter, which select provider capacity globally. Neither the request nor the failover path carries a processing region, so inference placement is not determined by the Customer's data region. Vallor therefore does not represent AI model inference as EU-resident, and protects these transfers contractually instead.