A sub-processor is a third party that processes personal data on Vonzay’s behalf and on its instructions, so that some part of the service works. The law requires us to say who they are. This page is that list, and it is Annex III to the data processing agreement.
The company that contracts these providers and answers for them is Vonzay Ecuador S.A.S., which operates the service under the Vonzay name. The team that runs the service is in Ecuador; the server and the vault run on infrastructure rented from the provider in the first row of the table, in the United States.
It is written for whoever has to approve Vonzay inside your company. If something here stops you signing, write to us and we will talk it through beforehand rather than after.
1. How to read the table
Each row is one provider. The data column says what that particular provider sees, not what the platform stores overall: each one receives only what its function requires. The country is where the provider is incorporated and, where we know it, the region it processes in. The last column goes to their own policy, not to a summary of ours.
2. Sub-processors in use
| Provider | What for | What data it touches | Country or region | Their policy |
|---|---|---|---|---|
| Hostinger International Ltd. | Running the platform: the server, its disk and the containers | Everything at rest: the database, the vault and the backups | Cyprus, with the data centre in the United States | Privacy policy |
| Anthropic | Serving the agent’s turns on Claude Code | The turn’s instruction, the conversation history and the contents of the files the agent reads or writes | United States | Privacy policy |
| OpenAI | Serving the agent’s turns on Codex, the alternative engine you pick per conversation | The same as the row above, when a conversation uses that engine | United States | Privacy policy |
| OpenAI, ChatGPT web interface | Generating images with the free tool | The prompt text and any reference images taken from the vault | United States | Privacy policy |
| NEXUSAI SERVICES LLC, which operates kie.ai | Generating images in bulk and generating video | The prompt text, and the reference image, video or audio their servers download over a signed link | United States | Privacy policy |
| Backblaze | Archiving off the server the media that is no longer used daily | The archived binary files: video, audio, images, PDFs and other attachments | United States, with the bucket in the US West region (us-west-004) | Privacy policy |
| Amazon Web Services, SES | Sending the service’s own email and relaying outbound mail from your company’s mailboxes | Sender, recipients, subject and body of outgoing messages, plus the domain and its signing identifiers | United States | Privacy policy |
| Cloudflare | Holding the DNS of our domains, without proxy: the records point straight at our server and the traffic does not cross their network | Domain names, DNS records and zone identifiers | United States, global network | Privacy policy |
| Browser push services: Google, Mozilla and Apple | Delivering the alerts you turned on to the subscribed device | The subscription endpoint, which identifies that device, and the timing of each delivery. The alert’s content is sealed and the provider does not read it | United States, global network | Google, Mozilla, Apple |
3. Four rows that need explaining
The free image generator runs on a shared account. It does not use a programming interface with a business contract: it drives an automated browser over a single ChatGPT account that every company on the platform shares today. Prompts and reference images from different companies end up in the history of that same account, which we administer. It is the one place in the product where tenant isolation does not reach the provider. If your company would rather not use that tool, write to us and we will agree to switch it off for your account.
We do not upload your files to kie.ai: we publish them. When you ask for video generated from an image or an audio file of yours, that file is exposed at a signed link that expires in thirty minutes and serves only that one file, and kie.ai’s servers download it from there. During those thirty minutes anyone holding the address can download the file without logging in, and there is no way today to revoke the link before it expires.
Mail is read on our server and sent through Amazon. The mailbox, the messages you receive and the historical archive live on the mail server we run. What goes out does pass through Amazon SES, which acts as the relay and therefore sees the recipient and the body of the message.
The infrastructure provider sees everything at rest. We do not encrypt documents at the application layer. Whoever administers the server can reach the files. This is also stated in clause 5 of the data processing agreement and on the security page, and it is one of the reasons we offer self-hosting.
4. Payment
There is no payment processor on this list today because we do not use one. Plans are taken out by email or through the contact form, how you pay is agreed in writing when you sign up, and none of your card details pass through us or through a third party working for us.
When we add a payment gateway, it will be a new sub-processor: it will appear in the table in section 2 with what it sees and where, and you will hear about it beforehand, as section 7 says.
5. Our own machines outside the data centre
Video rendering and audio stem separation run on a machine with a graphics card that belongs to us but does not sit in the data centre. That machine downloads the project material, processes it and returns the result.
No third party is involved: the hardware is Vonzay’s and nobody else operates it. We list it here anyway, because the file physically leaves the main infrastructure and that is the kind of detail a vendor review needs to know.
6. Self-hosted services: no third party here
A good deal of what is an API call to someone else in other products runs on our own machines in Vonzay and listens only on the loopback interface. There is no provider to name in this list because there is no provider:
| Function | How it works |
|---|---|
| Indexing and search | An open embeddings model installed on our server |
| Audio transcription | A speech recognition model installed on our server |
| Voice and video calls | A conferencing server of our own |
| Database, cache and link graph | On our machines |
| Receiving and storing mail | A mail server of our own |
| Embedded consoles for support, automation and publishing | Installed on our infrastructure |
What that means in practice: indexing twenty years of documentation sends not one byte to a model provider, and transcribing a two-hour meeting does not either. That content never leaves the server and we do not charge you for it. The only moment your content travels to a third party is when an agent works on it, or when you ask for an image or a video to be generated.
7. Notice before adding a new one
Before adding or replacing a sub-processor we give thirty days’ notice, in two ways at once:
- By email to each client company’s administrative contact.
- By publishing the change on this page and moving the date in the header.
If a security or continuity emergency forces us to replace a provider without those thirty days, we give notice as soon as we can and explain why. The right to object in the next section survives unchanged.
8. How to object
Write to sales@vonzay.com within fifteen days of the notice, naming the provider and the reason. The reason has to be about data protection: the country, the purpose, the provider’s safeguards, a conflict with your own internal policy.
What happens next:
- We look for a reasonable alternative or a measure that resolves the concern, and we answer you.
- If we find none within thirty days, you may terminate the affected part of the service, or the whole contract, with no penalty, and we hand back your vault and your database under clause 9 of the data processing agreement.
And what this takes from you, said here and not in small print: if you do not reply within those fifteen days, the change counts as accepted and the provider goes into service.
9. What is not on this list
- Providers you hire. If you connect your own account with some service and give us a credential, that provider is yours and works for you. We store that credential encrypted and use it only for what you ask.
- Sites the agent visits. When the agent opens a web page or downloads a public video, that site receives the request, but it receives none of your content.
- Authorities. We hand over information when a competent authority requires it through legal channels. That is not processing on instruction and it is not authorized by contract.
10. If something here does not sit right
Write to sales@vonzay.com. If your company needs none of these providers involved at all, the way out is self-hosting: Vonzay installed on the server and in the country you choose, with the models you contract yourself.