This page is the Subprocessor List referred to in our Privacy Policy and in our Service Terms. It identifies the third parties that Eldarion Solutions S.L. (“Eldarion”) engages to process personal data on behalf of its customers, the service each one provides, where it processes and the transfer mechanism that applies. Capitalised terms not defined here have the meanings given to them in the Privacy Policy and the Service Terms.
We keep this list current and publish it so that customers, and the people whose data they entrust to us, can see exactly who processes that data, for what and where. Entries highlighted in yellow are pending confirmation and will be completed before this list is relied on contractually.
A “Subprocessor” is a third party engaged by Eldarion that processes personal data on behalf of, and under the instructions of, our customers. Where you use the Services through a customer account, your organisation is the controller, Eldarion acts as processor, and the parties listed on this page are subprocessors within the meaning of Article 28(4) GDPR. Where Eldarion itself is the controller — for example for visitors to our public website, or for our own marketing and administration — the same parties act as our processors under Article 28(3).
Every party on this list is bound by a written contract that meets Article 28 GDPR, restricts processing to documented instructions, imposes confidentiality and security obligations equivalent to our own, and passes through the data protection commitments we make to our customers. We carry out security and privacy due diligence before a subprocessor is engaged and review it periodically thereafter.
This list does not cover parties to whom we disclose personal data as independent controllers rather than as subprocessors — for example our professional advisers, auditors, and regulators or courts where disclosure is legally required. Those recipients are described in section 04 of the Privacy Policy.
Our production environment runs in a single European region. Customer Data at rest does not leave it except where a customer enables one of the optional features described in section 04 below.
| Subprocessor | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| Google Cloud Platform [CONTRACTING ENTITY] |
Hosting of the production environment, together with the associated managed database, object storage, logging and backup services. | europe-west1 (Belgium), EEA | Processing within the EEA. EU Standard Contractual Clauses cover any support access from outside the EEA. |
Foundation model providers perform inference on our behalf under enterprise terms that prohibit training on submitted content and that require deletion after the request is served, save where retention is needed to comply with applicable law or to enforce acceptable use policies.
| Subprocessor | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| Anthropic [CONTRACTING ENTITY] |
Inference for the AI features of the Services, under enterprise terms that prohibit training on submitted content. | [INFERENCE REGION] | [TRANSFER MECHANISM] |
| [OTHER MODEL PROVIDERS, IF ANY] | Inference for specific model families exposed in the Services. | [REGION] | [TRANSFER MECHANISM] |
The subprocessors in this section support features that your administrators choose to enable for your workspace. As stated in the Service Terms, they process Customer Data and Content in the locations specified below and may not process in your selected data processing region. If a feature is not enabled, its subprocessor receives no Customer Data.
| Feature | Subprocessor | Processing location | Transfer mechanism |
|---|---|---|---|
| Web Browsing Feature (Web Browsing Subprocessor) |
[WEB SEARCH SUBPROCESSOR] | [REGION] | [TRANSFER MECHANISM] |
| Knowledge Sources (Knowledge Source Subprocessor) |
[KNOWLEDGE SOURCES SUBPROCESSOR] | [REGION] | [TRANSFER MECHANISM] |
| Ask [PROVIDER] (Research Subprocessor) |
[EMBEDDED RESEARCH PROVIDER] | [REGION] | [TRANSFER MECHANISM] |
| Email Eldarion (Email Subprocessor) |
[EMAIL SUBPROCESSOR] | [REGION] | [TRANSFER MECHANISM] |
The financial reference data suppliers whose datasets power the research surfaces. These providers receive query parameters needed to serve a request; they do not receive Customer Data or Content except where a query itself contains it.
| Subprocessor | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| [MARKET DATA PROVIDER] | Financial reference, pricing and fundamentals data used by the research surfaces. | [REGION] | [TRANSFER MECHANISM] |
Vendors that support the delivery, security and administration of the Services and of our website.
| Subprocessor | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| [EMAIL DELIVERY PROVIDER] | Transactional and notification email delivery. | [REGION] | [TRANSFER MECHANISM] |
| [WORKSPACE SUITE] | Corporate email, calendar and document collaboration used to support customers. | [REGION] | [TRANSFER MECHANISM] |
| [ERROR MONITORING / OBSERVABILITY] | Error monitoring, performance tracing and application logging. | [REGION] | [TRANSFER MECHANISM] |
| [SUPPORT TOOL] | Customer support ticketing and in-product help. | [REGION] | [TRANSFER MECHANISM] |
| [PRODUCT AND WEB ANALYTICS] | Usage and website analytics, subject to your cookie choices as described in the Cookie Policy. | [REGION] | [TRANSFER MECHANISM] |
| CookieYes [CONTRACTING ENTITY] |
Consent management platform on our public website: records and stores cookie consent choices. | [REGION] | [TRANSFER MECHANISM] |
| Google Fonts [CONTRACTING ENTITY] |
Delivery of the typefaces used by our public website; receives the visitor’s IP address as part of the request. | [REGION] | [TRANSFER MECHANISM] |
| [PAYMENTS AND BILLING GATEWAY] | Processing of subscription payments and maintenance of billing records. | [REGION] | [TRANSFER MECHANISM] |
Entities within the Eldarion group may process personal data for the operational, administrative and support purposes described in the Privacy Policy. Affiliates act under intra-group data processing terms that impose the same obligations as those we accept towards our customers.
| Affiliate | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| [GROUP AFFILIATES, IF ANY] | Operational, administrative and customer support functions. | [REGION] | [TRANSFER MECHANISM] |
We update this page whenever we appoint a new subprocessor or replace an existing one. Customers may subscribe to change notifications by writing to admin@eldarion.ai, and we will give notice at least [NOTICE PERIOD — MUST MATCH THE DPA] before the new subprocessor begins processing Customer Data.
A customer may object to a new subprocessor on reasonable data protection grounds within that notice period. If we cannot make the Services available without the subprocessor, and cannot reasonably accommodate the objection, the customer may terminate the affected part of the Services in accordance with the data processing terms agreed with us.
An up-to-date copy of this list is also provided to customers on request, together with a copy of the relevant transfer mechanism with commercially sensitive terms redacted.
Eldarion · Subprocessor List v1.0 · 1 September 2026