Sub-processors List
Last Updated: April 15, 2026
This page lists the third-party sub-processors that Smalt AI PLT ("Smalt AI") uses to process personal data on behalf of our customers. This list is maintained in accordance with our Data Processing Agreement (DPA).
Change Notifications: We will update this page and notify customers at least 30 days before adding a new sub-processor. To receive notifications, ensure your account administrator's email is current, or subscribe to updates by emailing support@smaltai.com.
Current Sub-processors
Infrastructure & Hosting
| Sub-processor | Purpose | Data Processed | Location |
|---|
| Amazon Web Services (AWS) |
Cloud infrastructure, hosting, data storage, compute |
All customer data (encrypted at rest and in transit) |
United States / EU (configurable for enterprise) |
AI Model Providers
| Sub-processor | Purpose | Data Processed | Location |
|---|
| Anthropic (Claude) |
AI language model for text generation, analysis, and reasoning |
User prompts and conversation content (not retained by Anthropic for training) |
United States |
| Google (Gemini) |
AI language model for text generation and analysis |
User prompts and conversation content (not retained by Google for training) |
United States |
Payment Processing
| Sub-processor | Purpose | Data Processed | Location |
|---|
| Stripe |
Payment processing, subscription billing |
Name, email, billing address, payment method tokens |
United States |
Email & Communication
| Sub-processor | Purpose | Data Processed | Location |
|---|
| Amazon SES |
Transactional email delivery |
Email address, email content |
United States |
| Resend |
Email delivery service |
Email address, email content |
United States |
Analytics & Monitoring
| Sub-processor | Purpose | Data Processed | Location |
|---|
| Google Analytics |
Website analytics (anonymised IP) |
Anonymised usage data, device information |
United States |
Data Transfer Safeguards
For sub-processors located outside the UK/EEA, we ensure appropriate data transfer mechanisms are in place:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- UK International Data Transfer Addendum (IDTA) for UK-origin data
- Data Processing Agreements (DPAs) with each sub-processor
How to Object to a New Sub-processor
Under our DPA, you have the right to object to the addition of a new sub-processor:
- You will receive email notification at least 30 days before a new sub-processor begins processing data.
- To object, send a written notice to support@smaltai.com within 14 days of notification.
- We will work with you in good faith to address your concerns.
- If we cannot resolve the objection, you may terminate the affected portion of the Service.
Change Log
| Date | Change |
|---|
| April 15, 2026 | Initial publication of sub-processors list. |
Contact
Smalt AI PLT - Data Protection
Email: support@smaltai.com
Website: www.smaltai.com