Sub-Processors
UpdatedSeptember 19, 2026
This list of Sub-Processors is published in accordance with Section 7 of our Data Processing Agreement. We engage carefully selected Sub-Processors to provide infrastructure, AI model APIs, payment processing, transactional email and code-repository integration. We notify Customers of changes at least 30 days in advance and allow objection on reasonable data-protection grounds.
To receive change notifications by email, subscribe at privacy@airbuild.ai.
Last update (September 19, 2026): added Google Analytics 4 for the marketing website, replaced ESLint with Ruff and Biome in the quality tooling, and clarified the AI-provider, SonarQube and data-residency entries.
Announced change (September 19, 2026): the DeepSeek models move off DeepSeek's own API in China and run as open weights at Lyceum in the EU; Kimi K3, Qwen3-Coder and GLM-5.3 arrive the same way. Lyceum is added as a Sub-Processor and DeepSeek is removed as one. For inputs and outputs this removes both the third-country transfer and the previous opt-in exception to the no-training commitment. Objections on reasonable data-protection grounds within 30 days to privacy@airbuild.ai.
1. Infrastructure
| Sub-Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure (compute, storage, database, networking, EFS, S3, CloudFront, ALB) | Frankfurt, Germany (eu-central-1) — primary region for production workloads | EU entity; for any incidental US transfers: Standard Contractual Clauses and supplementary measures |
2. AI model providers
| Sub-Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic (Claude, via Amazon Bedrock) | Large-language-model API (Claude) for chat, code generation and agent runtimes — served through Amazon Bedrock | European Union (Amazon Bedrock, EU region) for most Claude models; Claude Fable 5 uses Bedrock's global inference profile and may be processed outside the EU | Most Claude models are processed within the EU via Amazon Bedrock. Claude Fable 5 currently runs on Bedrock's global cross-region inference profile and may be processed outside the EU, safeguarded by AWS Standard Contractual Clauses. As a technical fallback, requests may be routed directly to Anthropic PBC (USA) under the EU–US Data Privacy Framework / Standard Contractual Clauses. Inputs and outputs are not used to train models. |
| OpenAI, L.L.C. | Optional large-language-model API for chat and code generation, used only when a Customer selects an OpenAI model — called directly via the official OpenAI API | United States (model APIs) | Standard Contractual Clauses + supplementary measures; API data not used to train OpenAI models |
| Mistral AI SAS | Optional large-language-model API for chat and code generation, used only when a Customer selects a Mistral model — called directly via the official Mistral API | European Union (France) | EU-based provider (Paris); processed via the official Mistral API and not used to train Mistral models |
| Google Ireland Limited / Google LLC | Gemini / Vertex AI model API — for chat and code generation when a Customer selects a Gemini model, and for AI image generation whichever chat model is selected; Google OAuth for sign-in | European Union and United States | Standard Contractual Clauses + supplementary measures |
| Lyceum Technology Germany GmbH | Managed inference for the open-weight models in the model picker — DeepSeek, Kimi K3, Qwen3-Coder and GLM-5.3 — and the default route for each of them | European Union — served from European data centres; GLM-5.3 Flash from Paris. Provider seat: Berlin, Germany (Amtsgericht Charlottenburg, HRB 274593 B) | Processed within the European Union by a German company, so no third-country transfer takes place. The models run as open weights on Lyceum's infrastructure, so the organisation that originally published a model receives no data. Lyceum's terms provide that inference inputs and outputs are processed only to produce the Customer's result, are not stored beyond what is technically necessary for that purpose, and are not used for training. |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek, native route) | Optional large-language-model API for chat and code generation, used only when a Customer selects the native DeepSeek route | China (People's Republic of China) | Exception to EU residency and no-training (see §5 and §6). DeepSeek's privacy policy states that personal data is collected, processed and stored in the People's Republic of China and used to train and improve its models. Transfers rely on Standard Contractual Clauses, supplementary measures and the Customer's explicit opt-in. The same model is available EU-hosted through Lyceum, which is the default. |
| Moonshot AI PTE. LTD. (Kimi, native route) | Optional large-language-model API (Kimi K3) for chat and code generation, used only when a Customer selects the native Kimi route | Singapore (contracting entity and governing law). The processing location is not stated in the provider's terms. | Exception to EU residency and no-training (see §5 and §6). Moonshot's platform terms permit using Content — inputs and outputs — to develop and improve the Services by default; restrictions require a separate enterprise arrangement. Singapore is not covered by an EU adequacy decision, so transfers rely on Standard Contractual Clauses, supplementary measures and the Customer's explicit opt-in. The same model is available EU-hosted through Lyceum, which is the default. |
| Jingsheng Hengxing Technology Pte. Ltd. (Z.ai / GLM, native route) | Optional large-language-model API (GLM-5.3, GLM-5.3 Flash) for chat and code generation, used only when a Customer selects the native GLM route | Singapore (10 Anson Road, International Plaza) | Exception to EU residency (see §5). The provider states that personal data is generally processed in Singapore and that content sent to the API is processed in real time and not stored on its servers. Singapore is not covered by an EU adequacy decision, so transfers rely on Standard Contractual Clauses, supplementary measures and the Customer's explicit opt-in. The same models are available EU-hosted through Lyceum, which is the default. |
| Alibaba Cloud (Singapore) Private Limited (Qwen, native route, EU endpoint) | Optional large-language-model API (Qwen3-Coder, via Alibaba Cloud Model Studio) for chat and code generation, used only when a Customer selects the native Qwen route | European Union (Frankfurt) — Model Studio EU endpoint | Inference runs on the Frankfurt endpoint, so the request itself is processed in the EU, and Alibaba Cloud states that customer business data is not used to develop or improve models without explicit consent. The contracting entity is nevertheless incorporated in Singapore, and Alibaba Cloud's EEA Data Processing Addendum commits to no specific processing region and does not exclude support access from outside the EEA — so Standard Contractual Clauses and supplementary measures remain the transfer basis for that residual access. Unlike the other native routes, this one is not an exception to §5 or §6. |
3. Operations (payment, email, code)
| Sub-Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. / Stripe Inc. | Payment processing for subscriptions and credit purchases | Ireland (controller for payment data); United States for fallback infrastructure | Standard Contractual Clauses + EU–US Data Privacy Framework |
| Sendinblue / Brevo SAS | Transactional email (account, billing, security notifications) | European Union (France) | EU/EEA — no third-country transfer |
| GitHub, Inc. | Code repository, Git operations and OAuth for Customers who connect a repository | United States | Standard Contractual Clauses |
4. Analytics (Service and website)
| Sub-Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Internal product analytics (self-hosted) | Aggregated, pseudonymised product-usage analytics inside the Service, for operating and improving it. No third-party analytics or advertising trackers are embedded in the Service. | European Union (Frankfurt) | EU/EEA — no third-country transfer |
| Google Ireland Limited / Google LLC (Google Analytics 4 — website only) | Web analytics for the airbuild.ai marketing website only. Loaded only after the visitor accepts the “Analytics” category in the cookie banner; IP addresses are processed in anonymised form. Not used inside the Service and not used to process Customer Personal Data — listed here for transparency; see the Privacy Policy. | European Union and United States | Standard Contractual Clauses + EU–US Data Privacy Framework |
5. Data residency commitment
Application data (workspaces, projects, generated code, files, databases, published sites) is hosted in the European Union (Frankfurt, Germany). Published sites are delivered through Amazon CloudFront's global edge network: their public files (pages, scripts, images) are cached at edge locations that may be outside the EU, while origins, databases and stored files stay in Frankfurt. Personal Data is transferred to non-EEA Sub-Processors only as necessary to process AI requests and other features listed above, under the transfer mechanisms identified.
6. No training on Customer data
We do not use User Content (prompts, code, files, AI Output, secrets, configurations) to train, fine-tune or evaluate foundation models, whether ours or those of any AI provider listed above, and we do not share User Content with any AI provider for training purposes. Anonymous, aggregated telemetry (token counts, latency, error rates) may be used for operating and improving the Service. See Section 7 of the Terms.
Exception — native routes: every open-weight model is offered twice: EU-hosted through Lyceum, which is the default, and natively through the provider's own API. If a Customer explicitly selects a native route, the inputs sent to it are processed under that provider's own terms and outside the EU; those terms may permit the provider to use inputs to improve its models. The list above identifies which routes this applies to. No native route is used unless it is selected.
In addition to the Sub-Processors above, Airbuild runs the following open-source quality- and security-assurance tools inside its own EU build pipeline. They analyse Customers' generated code, not personal data, and — unless noted otherwise — send nothing to a third party.
7. Quality & security tooling (open source)
| Sub-Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| SonarQube Cloud (SonarSource SA) | Code-quality gate — static analysis of generated code before publishing | European Union — SonarQube Cloud, hosted on AWS eu-central-1 (Frankfurt); provider SonarSource SA, Switzerland | Analysis data is processed in the EU (AWS Frankfurt). SonarSource SA is based in Switzerland, which holds an EU adequacy decision (Art. 45 GDPR). Each scan runs in a throwaway analysis project that we delete once the scan finishes; where a deletion does not complete, retention follows SonarSource's terms. |
| Trivy (Aqua Security · open source) | Dependency & vulnerability scanning (known CVEs, secrets) of generated apps | European Union — self-hosted CLI in Airbuild's pipeline (no third-party transfer) | EU/EEA — no third-country transfer |
| OWASP ZAP (open source) | Dynamic application security testing (DAST) of the deployed app before publishing | European Union — self-hosted in Airbuild's infrastructure (no third-party transfer) | EU/EEA — no third-country transfer |
| Semgrep (open source) | Static application security testing (SAST) of generated code | European Union — self-hosted CLI in Airbuild's pipeline (no third-party transfer) | EU/EEA — no third-country transfer |
| Spectral (Stoplight · open source) | Linting of the generated OpenAPI specification before publishing | European Union — self-hosted CLI in Airbuild's pipeline (no third-party transfer) | EU/EEA — no third-country transfer |
| Ruff (Astral · open source) | Code-quality and security linting (bandit ruleset) of generated Python backends | European Union — self-hosted CLI in Airbuild's pipeline (no third-party transfer) | EU/EEA — no third-country transfer |
| Biome (open source) | Code-quality and correctness linting of generated TypeScript/React frontends | European Union — self-hosted CLI in Airbuild's pipeline (no third-party transfer) | EU/EEA — no third-country transfer |