A short list, EU-first, published in full. Hosting, AI and the database run in Google Cloud's Belgium region.
Third parties that process personal data on Avatorial's behalf, why they do, and where. Last updated: 27 July 2026. Material changes are announced by email to workspace owners at least 30 days in advance.
| Sub-processor | Purpose | Location of processing | Safeguards |
|---|---|---|---|
| Google Cloud (Google Ireland Ltd) | Application hosting (Cloud Run), database (Cloud SQL), media storage, secret storage, AI drafting & embeddings (Vertex AI) | EU — europe-west1 (Belgium) | GDPR DPA, SCCs, ISO 27001, SOC 2 |
| Stripe Payments Europe Ltd | Subscription billing, payment processing, VAT calculation | EU / US (SCCs) | PCI-DSS Level 1, GDPR DPA, SCCs |
| Twilio SendGrid | Transactional email (draft reminders, account notices) | US (SCCs) | GDPR DPA, SCCs, SOC 2 |
| Microsoft Ireland (Entra ID) | Optional sign-in with Microsoft work accounts | EU | GDPR DPA, ISO 27001 |
| Google Ireland (Google Sign-In) | Optional sign-in with Google accounts | EU | GDPR DPA, ISO 27001 |
LinkedIn and Reddit are not sub-processors: you connect your own accounts and content flows to them only when you approve a post, under their own terms with you. AI processing runs on Vertex AI inside the EU region; your content is not used to train foundation models.