1. About this list
Vantafold engages the subprocessors below to deliver the service. Each is reviewed before onboarding and annually thereafter, and each is bound by a written agreement with confidentiality and security obligations no less protective than our Data Processing Addendum.
Names here are placeholders for the purposes of this template. Replace them with your actual vendors, and keep the list current — it is the document auditors check first.
2. Current subprocessors
| Subprocessor | Purpose | Processing locations | Category |
|---|---|---|---|
| Cloud infrastructure provider A | Compute and storage for the gateway and router | United States, Germany, Ireland, Japan, Singapore | Infrastructure |
| Cloud infrastructure provider B | Compute for open-weight model serving | United States, Germany | Infrastructure |
| Model provider — Meridian | Frontier model inference | United States, Ireland | Model provider |
| Model provider — Northwind | Frontier model inference | United States | Model provider |
| Model provider — Cirrus | Specialist model inference | European Union | Model provider |
| Object storage provider | Trace and backup storage | United States, Germany | Infrastructure |
| Observability vendor | Internal platform telemetry (no customer request content) | United States | Operations |
| Payments processor | Billing, invoicing, and payment collection | United States, Ireland | Business operations |
| Customer support platform | Support ticketing and shared channels | United States | Business operations |
| Email delivery provider | Transactional and service email | United States | Business operations |
| Identity provider | Staff single sign-on (no customer data) | United States | Internal |
Customers with data residency enabled are served only by subprocessors operating in the selected region. Model providers outside that region are excluded from routing rather than used as a fallback.
3. A note on model providers
Model providers are subprocessors whenever a request is routed to them. Which providers process a given customer's data therefore depends on that customer's routing policy and model allow-list.
Customers can restrict routing to a specific set of providers, or to models Vantafold operates directly, using project-level policy. Every provider agreement prohibits training on data routed through Vantafold.
4. Notice of changes
We give at least 30 days' notice before adding or replacing a subprocessor. Notice is posted on this page and sent by email to workspace administrators who have subscribed to subprocessor notifications.
Customers may object on reasonable data-protection grounds within the notice period, as described in the DPA.
5. Subscribe to updates
Workspace administrators can enable subprocessor notifications in the dashboard under Settings → Notifications. To subscribe without an account, write to privacy@vantafold.ai.
Questions about this document? Write to legal@vantafold.ai, or see the contact page for our registered entities.