# Sub-processors

Source: https://docs.serenityedge.ai/terms/sub-processors/

> **Document control**
> 
> | Field | Value |
> | --- | --- |
> | Version | 1.1 |
> | Effective date | 17 October 2026 |
> | Last revised | 17 October 2026 |
> | Approved by | Substrate Artificial Inteligence, S.A. |
> | Contracting entity | Substrate Artificial Inteligence, S.A. |
> 
> The full version history is available in the [Legal document changelog](https://docs.serenityedge.ai/terms/changelog/).

This page is the up-to-date list of Sub-processors referred to in clause 6 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) and in section 6 of the [Privacy Policy](https://docs.serenityedge.ai/terms/privacy-policy/). Section 1 lists the Platform Sub-processors engaged under clause 6.2. Section 2 lists the Access Route Providers engaged under clause 6.4. Section 3 explains why the Platforms (routers, gateways and marketplaces such as OpenRouter, cortecs or EUrouter), addressed in clause 6.5, are not Sub-processors.

A Sub-processor is a third party engaged by Substrate Artificial Inteligence, S.A. to Process Personal Data on behalf of a Customer. Capitalised terms have the meaning given to them in the Data Processing Agreement.

Serenity Edge is designed so that the Inputs a Customer sends and the Outputs it receives are processed in memory and never written to disk or logs; prompt prefixes may be kept in a volatile memory cache for at most 24 hours, after which they are automatically evicted. The columns below therefore distinguish between Personal Data that a Sub-processor handles in volatile memory only and Personal Data that it retains.

## 1\. Platform Sub-processors

These Sub-processors support the delivery of the Services for every Customer, irrespective of the access route the Customer chooses. They are engaged under clause 6.2 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/).

| Sub-processor | Service provided | Categories of Personal Data | Region of Processing | Basis for international transfer |
| --- | --- | --- | --- | --- |
| Cloudflare, Inc. | Edge network for the API and the documentation website: DNS, TLS termination, protection against denial-of-service attacks and web application firewall | IP address and request metadata (headers, timing, status) for every request reaching the edge, which Cloudflare retains in its security logs. Inputs and Outputs pass through the edge in transit only and are not stored | Global anycast network; traffic from the European Union is handled in Cloudflare's European Union data centres | EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for any access from outside the EEA |
| Microsoft Ireland Operations Limited (Microsoft Azure) | Request handling for the API: authentication, rate limiting and routing of requests to the inference infrastructure; managed key vault for secrets; operational and security logs | Request Metadata, API Key identifiers and technical and security logs, which never contain message content. Inputs and Outputs in memory while the request is handled; nothing is written to disk or logs | Spain (Azure Spain Central) | Not applicable (EEA) |
| Subgen AI Spain, S.L. (group company) | Operation, on Substrate AI's behalf, of the GPU facility in Valencia where inference runs | Inputs and Outputs in volatile memory during inference, including prompt prefixes cached for at most 24 hours; nothing is written to disk or logs | Spain (Valencia) | Not applicable (EEA). Intra-group data processing agreement between Substrate Artificial Inteligence, S.A. and Subgen AI Spain, S.L.: in preparation |
| Better Stack, Inc. | Status page at [https://status.serenityedge.ai](https://status.serenityedge.ai/): publication of service status and incident notices, external availability checks of the API, and delivery of status notifications to subscribers where subscriptions are offered | Email address of the subscribers to status notifications, where a Customer chooses to subscribe. The availability checks use a Substrate AI key and synthetic prompts, never Customer data | European Union by default; some of its sub-processors are in the United States | Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, under Better Stack's Data Processing Agreement |

Substrate AI's request-handling layer and inference infrastructure are internal systems running on the providers above within Substrate AI's own tenant and facility. They are not separate Sub-processors.

## 2\. Access Route Providers

These providers are engaged under clause 6.4 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/). A provider Processes Personal Data only where the Customer has chosen the corresponding access route. A Customer that does not use that route sends that provider no data.

| Provider | Access route | Service provided | Categories of Personal Data | Region of Processing | Basis for international transfer |
| --- | --- | --- | --- | --- | --- |
| Subgen AI Spain, S.L. (Serenity Star) | Serenity Star account | Account creation, authentication, API Key management, sale of Credits, metering of usage against Credits and invoicing for Serenity Star account traffic | Identity, account, contact, payment and billing data of the Customer; API Key identifiers; token counts and usage totals per API Key. Serenity Star does not receive Inputs or Outputs | European Union (Microsoft Azure France Central) | Not applicable (EEA) |

For account, contact and billing data, Subgen AI Spain, S.L. acts as the operator of Serenity Star under the [Serenity Star terms](https://docs.serenitystar.ai/terms/terms-of-use) and privacy policy. For the operation of the Valencia facility, it acts as a Platform Sub-processor listed in section 1. The intra-group data processing agreement that governs both activities is in preparation.

Under an enterprise contract, no additional provider is engaged: API Keys are issued by Substrate AI and invoices are issued by Substrate Artificial Inteligence, S.A. directly.

## 3\. Platforms

A Platform is a third-party router, gateway or marketplace, such as OpenRouter, cortecs or EUrouter, through which a Customer may access the Services. The Platforms on which the Services are available, and those on which their onboarding is in progress, are listed at [https://docs.serenityedge.ai/docs/access/channels](https://docs.serenityedge.ai/docs/access/channels/). When a Customer uses a Platform as a marketplace, the Customer contracts with the Platform under the Platform's own terms, sends its requests to the Platform, and the Platform forwards them to the API, returns the Outputs and bills the Customer. Substrate AI does not select, evaluate or contract with the Platform on behalf of the Customer, receives the requests that the Platform forwards and returns the Outputs as instructed by the Customer through that route. A Platform is therefore not a Sub-processor engaged by Substrate AI and is not listed above. Clause 6.5 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) sets out how that route is treated, and the Customer is responsible for the leg between itself and the Platform, including any transfer outside the European Economic Area that it entails.

A Platform that resells the Services in its own name signs a Platform Partner Addendum with Substrate AI, and any other Platform that processes its customers' Personal Data as their Data Processor may sign one. Under it, the Platform is the Customer and Substrate AI acts as the Platform's sub-processor, as set out in clause 6.5 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/).

## 4\. Changes to this list

In accordance with clause 6.6 of the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/), for the Platform Sub-processors in section 1:

-   **Notice period.** Substrate AI gives at least thirty (30) days of notice before a new Sub-processor starts Processing Personal Data on behalf of a Customer, save where the change is required to address a security incident or a legal requirement, in which case Substrate AI gives as much notice as is reasonably practicable.
-   **Channel.** Changes are published on this page and, where Substrate AI holds an email address for the Customer, notified by email to the address associated with the Customer's account or enterprise contract.
-   **Objection.** Customers may object to a new Sub-processor within thirty (30) days of notification under clause 6.3. If no resolution is reached, the Customer may terminate the affected Services.
-   **Subscription.** To be notified of changes to this list, write to [contact@substrate.ai](mailto:contact@substrate.ai).

## 5\. Contact

Questions about this list, about a specific Sub-processor or about the safeguards applied to an international transfer can be sent to [contact@substrate.ai](mailto:contact@substrate.ai), or by post to Substrate Artificial Inteligence, S.A., Attn: Privacy, Avenida Real Fábrica de Sedas 28, 45600 Talavera de la Reina (Toledo), Spain.