Sub-processors

This is the list that Appendix B of the data processing agreement refers to. Before we engage a new sub-processor or replace one, we notify customers’ administrators by e-mail at least 30 days in advance and update this page.

The customer’s content

Provider	What it does	Where
Supabase, Inc.	Database, file storage and sign-in. This is where projects, documents, models and user accounts are kept.	Ireland (AWS eu-west-1)
Railway Corporation	Application servers: the API and the services that process documents and models. Does not store customer data permanently.	The Netherlands (EU West, Amsterdam)
Resend, Inc.	Sending e-mail: invitations, notifications and summaries.	Ireland (eu-west-1)
OpenRouter, Inc.	Routes requests to the AI models below. The content is not used for training.	USA and other countries outside the EU/EEA

AI models, through OpenRouter

Provider	What it does	Where
Anthropic, PBC	Language models (Claude): analysis, drafting and the assistant, and directing visualisations, where the model sees images of the building.	USA and other countries outside the EU/EEA
Google LLC	Language, image and video models (Gemini, Veo): analysis, illustrations and video.	USA and other countries outside the EU/EEA
OpenAI, L.L.C.	Text embeddings for searching regulations: the search text is sent, documents are not. And the design assistant in the desktop app’s Blender studio (Astra), which receives the project brief and renders of the building model.	USA and other countries outside the EU/EEA
ByteDance	Video model (Seedance): short films of the building in directed mode. Receives approved keyframes of the building and a text description.	May be processed outside the EU/EEA
Black Forest Labs	Upscaling finished films to a higher resolution (FLUX), when the user chooses it. Fetches the film from a signed link that expires after one hour.	May be processed outside the EU/EEA
TypeSafe	Classification of public tender notices from Doffin. Receives public text only.	May be processed outside the EU/EEA

The transfers out of the EU/EEA are based on the European Commission’s standard contractual clauses or, for certified recipients, the EU–US Data Privacy Framework. See Appendix C.6 of the data processing agreement. We will move the AI processing to the EU when the selection of models there is at the same level.

Operating the website and the app

Provider	What it does	Where
Vercel Inc.	Delivers the static files of the website and the web app. Sees the IP address and technical details of the request. Stores no customer data.	Global delivery network
PostHog, Inc.	Usage statistics: named events with a random user and organisation ID, and anonymous visitor statistics from the website. No content, no names, no e-mail addresses. Here Arkiflyt is itself the data controller, see the privacy policy.	Germany (PostHog Cloud EU, Frankfurt)

Payments

Provider	What it does	Where
Stripe	Card payments for subscriptions and AI credits, invoices and receipts. Receives the business’s name, address and organisation number, the e-mail address of the person paying, and the card details, which never pass through Arkiflyt. For the payment itself Stripe is also a data controller in its own right.	Ireland, with transfers to the USA

Not sub-processors

The map and the address search in the app are fetched by your browser directly from the Norwegian Mapping Authority (Kartverket), and from OpenStreetMap if you choose that map layer. They do not process data on our behalf, but receive your IP address and what you look at or search for.

Look-ups in public sources, such as Doffin, Kartverket, SINTEF Byggforsk, the Brønnøysund Register Centre and municipal websites, are made with the project’s address, property, organisation number or search terms, not with data about people.