Subprocessors
Updated last month
This page identifies the providers used for Gratona’s core hosting and AI services. The Data Processing Addendum and its accepted customer schedule identify the subprocessors authorised for your selected services.
Core hosting and AI providers
Provider | Purpose and data | Location information |
|---|---|---|
DigitalOcean | Application and database hosting; customer records and service data needed to operate Gratona. | Primary production application and database: San Francisco, United States. |
Amazon Web Services (AWS) | Cloud infrastructure used to provide the service; customer data relevant to the services hosted there. | Gratona’s hosting configuration: United States. |
OpenAI | Translation and other authorised AI features; content submitted to the selected feature and related service metadata. | Processing is subject to the applicable OpenAI service, account configuration and provider subprocessor information. No EU-only processing commitment is included in the standard package. |
Anthropic | Authorised AI features; content submitted to the selected feature and related service metadata. | The provider states that data is stored in the US and processing may occur in other countries, depending on routing and service arrangements. See Anthropic’s location information. |
AI data use
Customer personal data is not used to train general-purpose AI models. See AI data and privacy for permitted processing, anonymisation requirements and choices concerning qualifying anonymised information.
Other services and integrations
The providers involved depend on the communications, support, payments and integrations used. The customer schedule records any additional subprocessors, their purpose and relevant locations. A service independently selected and contracted by you may act under your own agreement rather than as Gratona’s subprocessor.
International transfers and changes
Processing locations and lawful transfer safeguards are recorded in the applicable customer schedule. Where required, these include the EU Standard Contractual Clauses and relevant supplementary measures. A provider’s inclusion here does not itself establish a transfer mechanism.
The Data Processing Addendum governs notice of new or replacement subprocessors and your right to object on data-protection grounds. Contracting entities, service-specific processing locations and transfer arrangements are recorded in the accepted schedule.
For provider or data-processing questions, contact [email protected].