Sub-processors

Last updated: 5 August 2026 · Privacy Policy · Data Processing Agreement

The infrastructure and service providers below may process personal data on Sentilai's behalf. We update this page at least 30 days before a new sub-processor begins processing customer data; tenant admins can request email notice of changes at [email protected].

Sub-processor	Purpose	Data	Location
Hetzner Online GmbH	Cloud infrastructure (compute, database, object storage) for the EU region	All platform data	Germany / Finland (EU)
Cloudflare, Inc.	DNS, DDoS protection and reverse proxy (TLS termination) for all public endpoints; content delivery for application downloads (R2, EU jurisdiction)	Network traffic in transit, including AI request/response payloads while proxied; application binaries	Global edge; storage EU
Resend, Inc. (on Amazon Web Services, eu-west-1)	Transactional email (invitations, notifications) and inbound support-ticket email	Email addresses, notification content, customer-authored ticket replies and attachments	EU (eu-west-1 infrastructure); Resend is a US entity
Google (Workspace)	Sentilai's corporate mailboxes — support correspondence sent to us by email	Email content addressed to Sentilai staff	EU data regions; Google is a US entity
Mistral AI SAS	AI-based prompt-injection classification (security feature)	Outbound prompt text submitted for classification; Sentilai stores only category, severity and timing	France (EU)
Paddle.com Market Ltd	Merchant of Record for subscriptions — an independent controller for payment data, not a sub-processor in the Art. 28 sense	Billing contact, tax country; Sentilai never receives card data	UK / EU

Not sub-processors: the AI providers you route to

The LLM providers your requests are proxied to — Anthropic, OpenAI, Google, Azure OpenAI — are not Sentilai sub-processors. In managed-key mode those calls use your own API keys under your own provider agreement; in subscription mode your developers' own provider sessions pass through unchanged. You choose the providers, you hold the agreements; Sentilai surfaces — but does not enforce — provider-residency warnings.