List of
sub-processors
The dated list under clause 12.4 of the Terms of the third parties that access Customer data while the Service is provided.
Change on 20 October 2026: From 20 October 2026 the Claude language models run on AWS Bedrock inside the European Union; xAI leaves the list and Anthropic PBC moves from direct API provider to model licensor with no access to customer data. The change is a sub-processor change under clause 12.4 of the Terms; Customers may object until the effective date.
Effective from 20 October 2026
| Sub-processor | Registered seat | Activity | Processing location | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg (RCS B186284) | Running the Claude large language models on AWS Bedrock: document recognition and extraction, bank-statement extraction, chat assistant, matching and categorisation suggestions | EU — Frankfurt (eu-central-1) primarily; routed among EU regions only (Frankfurt, Ireland, Paris, Milan, Spain, Stockholm); no data leaves the EU | Processing within the EU; AWS Data Processing Addendum + 2021/914 EU SCCs (Module 2). The residual government-access risk is described in the Privacy Notice. |
| Cohere Inc. | Toronto, Canada (partly US infrastructure) | Text embeddings for semantic search | Canada / USA | 2021/914 EU SCCs (Module 2); supplemented by the Canadian adequacy decision |
| Hostinger International Ltd. | Cyprus; data centre in Germany | Operating the Customer's dedicated server instance, database and file storage (virtual servers) | EU — Germany | Processing within the EU; Hostinger DPA |
| Deepgram, Inc. — only if the Meetings feature is enabled | USA | Transcription of meeting recordings (Meetings) | USA | 2021/914 EU SCCs (Module 2). The feature is off by default; enabling it is the Customer's decision. |
Not a sub-processor, for information
Anthropic PBC (USA) — developer and licensor of the Claude models; in the AWS Bedrock setup it has no access to customer data and is therefore not a sub-processor under Article 28(2) GDPR. The Provider's self-hosted mail server and AI gateway layer are part of the Provider's own infrastructure, not third parties.
Currently in force (1 May 2026 – 19 October 2026)
| Sub-processor | Registered seat | Activity | Processing location | Transfer basis |
|---|---|---|---|---|
| xAI, Inc. | USA | Language model (Grok) — chat and text processing | USA | SCC 2021/914, Module 2 — no longer used by the Service; removed on 20 October 2026 |
| Anthropic PBC | USA | Language model (Claude) — direct API | USA | EU–US Data Privacy Framework + SCC — replaced by AWS Bedrock EU on 20 October 2026 |
| Cohere Inc. | Canada (US infra too) | Text embeddings | Canada / USA | Canadian adequacy decision + SCC |
| Hostinger International Ltd. | EU (Germany) | Dedicated server, database, file storage | EU — Germany | Processing within the EU |
Notice and objection
We notify Customers by e-mail at least 30 days before a new sub-processor is engaged, an existing one is replaced or its scope is extended, and show the notice inside the Service as well. Customers may object until the effective date; failing agreement they may terminate the subscription as of the effective date without adverse consequences.
Questions: info@mivir.hu · Privacy Notice
Previous versions
2026-04 (v1) — the table published in clause 12.4 of the Terms: xAI, Anthropic PBC, Cohere, Supabase.