Sub-processors — 2026-11-05 (archived)

Since 9 October 2026, System1 Models operates under the name Decision Models (decisionmodels.io). References to System1 Models and system1models.ai in this document mean Decision Models and decisionmodels.io; nothing else changes.

Last updated: 5 November 2026

This page is the current list referred to in Annex 3 of our Data Processing Agreement. Where the Annex 3 copy on the DPA page differs from this list, this page is the current list (DPA section 6.2). For providers processing API content under the DPA, we announce additions or replacements at least 7 days in advance by email and on this page (30 days for customers who accepted DPA version 1.2 or earlier and have not accepted version 1.3); you may object as described in section 6.2 (the 6 Oct 2026 UpCloud addition is an exception, see change history). Account data processed for our own purposes is outside the DPA under section 1.2 and is covered by our Privacy Policy.

May process API content — tier scope below

Sub-processor	Service	Location of processing	Safeguard
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of the websites (including the dashboard), API gateway, database and encrypted backups	EU (data centre in Helsinki, Finland)	Provider's standard Art. 28 GDPR agreement required before customer-data processing; ISO/IEC 27001:2022 certificate No. ZN-2025-35 (SOCOTEC, valid until 26 Sep 2028), whose scope lists the Helsinki (Tuusula) data centre
UpCloud Oy, Helsinki, Finland	GPU servers for model inference: our always-on inference capacity since 7 October 2026 for the EU tier and for Peer-to-Peer/Global base capacity, plus additional servers when EU capacity is busy (those only for the EU tier)	Finland (EU), data centre FI-HEL2. From 30 November 2026 also UpCloud's other EU data centres: Helsinki FI-HEL1 (Finland), Stockholm SE-STO1 (Sweden), Copenhagen DK-CPH1 (Denmark), Frankfurt DE-FRA1 (Germany), Amsterdam NL-AMS1 (Netherlands), Warsaw PL-WAW1 (Poland) and Madrid ES-MAD1 (Spain); all in the EU	Art. 28 GDPR data processing terms in UpCloud's Terms of Service (effective 3 July 2026); EU data centres operated by UpCloud Oy without further sub-processors (per UpCloud's DPA); ISO/IEC 27001:2022 certificate No. 13851-03 (Kiwa Sertifiointi Oy, valid until 20 Oct 2029) for UpCloud's cloud service; the certificate excludes the co-location data centres, including FI-HEL2, from its scope; data centre FI-HEL2: ISO/IEC 27001:2022 certificate No. 14821-02 (Kiwa) of the operator Telia Finland Oyj for colocation from the Telia Helsinki Data Center, valid until 25 Sep 2027, provided by UpCloud; additional EU data centres from 30 Nov 2026, per the site certificates UpCloud sent us: DE-FRA1 (Digital Realty FRA14, Frankfurt), DK-CPH1 (Digital Realty CPH3, Ballerup), ES-MAD1 (Digital Realty MAD3, Madrid) and NL-AMS1 (Digital Realty AMS7, Schiphol-Rijk): ISO/IEC 27001:2022 certificates Nos. S171/35, 212597, S171/43 and S171/199 (NQA), valid until 11 Oct 2028; FI-HEL1, SE-STO1 and PL-WAW1 (Equinix, per UpCloud): Equinix ISO/IEC 27001:2022 certificate No. 1657824-3 (Schellman Compliance), valid until 30 Dec 2026, covering all Equinix data centres in the Helsinki area, Stockholm and Warsaw
Janusz Ciuruś, trading as BESTCONNECT CIURUŚ JANUSZ (brand: GPU Server Hub), Królówka, Poland, NIP 8681799622 (CEIDG). Data centre 4DataCenter Katowice, operated by Quicktel Sp. z o.o. (KRS 0000297311)	Since 23 October 2026 for EU-tier customers who agreed to this in writing; for all customers from 21 November 2026: dedicated bare-metal GPU servers (not shared with the provider's other customers), operated by us, for model inference: EU tier and Peer-to-Peer/Global base capacity, alongside UpCloud	Customer content on the servers: 4DataCenter Katowice, Poland (EU). The provider's order system and logs are on its own infrastructure in Poland. Transfers outside the EEA only on our documented instruction	Art. 28 GDPR data processing agreement: Annex 1 of the provider's B2B Service Terms v1.6 r2 (8 Oct 2026). Quicktel is the infrastructure subcontractor for colocation, power, cooling and physical security. It is a sub-processor only if it handles personal data on documented instruction, under an Art. 28(4) agreement. Quicktel holds ISO/IEC 27001 certificate No. 4414/10/2026/BI/C (PN-EN ISO/IEC 27001:2023, Polska Akademia Jakości Cert, valid until 18 Oct 2029) for its telecommunications and colocation services; the certificate names no individual data centre. No certification is asserted for GPU Server Hub itself
Lium (lium.io), with independent third-party GPU providers	On-demand GPU inference for opted-in Peer-to-Peer keys when spare EU capacity is busy	worldwide (third-party GPU providers)	Transfers outside the EU/EEA happen only for keys you opted in; you are responsible for not sending personal data on such keys unless an adequate transfer basis applies for your use. The switch itself is not a transfer basis under Chapter V GDPR.

EU-tier requests always stay in the EU. Without worldwide opt-in and without network processing (see below), Peer-to-Peer requests also stay in the EU. Request and response content is not stored on our gateway or our UpCloud inference servers. This does not extend to Lium GPU providers or to independent providers of the peer-to-peer network (see below). UpCloud runs our always-on GPU server and, while EU capacity is busy, additional servers that are deleted when no longer needed; dedicated GPU servers at GPU Server Hub in Katowice, Poland, run model inference since 23 October 2026 for EU-tier customers who agreed in writing, and for all customers from 21 November 2026 (see the table above). Until 29 November 2026, all UpCloud servers are in data centre FI-HEL2 only. From 30 November 2026 they may also run in the other UpCloud EU data centres listed in the table, never outside the EU. All UpCloud servers have encrypted disks and no request logs; request and response content is held in memory only for the duration of the request.

Account, billing and identity providers — no API content

The providers below may receive account, billing, contact or sign-in data, but no API request content from the Service. If you paste such content into an email to us, it reaches our mail providers. Their roles depend on the service: some act as processors on our instructions; Stripe and Google act as independent controllers for their own payment or identity services. See the Privacy Policy for details.

Provider	Service	Location	Role
Stripe Payments Europe, Ltd., Dublin, Ireland	Payments, tax calculation and invoices	EU; transfers to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses	Independent controller for payment processing; processor for invoicing
Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France	Service emails (sign-in links, receipts and notices); planned, not in use at present	EU (Paris, France)	Processor, once enabled; its Art. 28 GDPR agreement is concluded before first use
Resend (Plus Five Five, Inc., San Francisco, USA)	Sending our emails: sign-in links; account, hosting and promotional-credit notices; notices of changes to our documents; confirmations of and answers to requests; first-contact business emails; top-up and withdrawal confirmations. No Google sign-in data, card details or API content	Sending region Ireland; messages and delivery/account records stored in the USA	Processor for account and contact data under its DPA; SCCs and EU-U.S. Data Privacy Framework
Google Ireland Limited, Dublin, Ireland	Google sign-in (verified email and stable account ID only); our mailbox for mail you send to our addresses and for some notices we send	EU; transfers to Google LLC (USA) may occur under the EU-U.S. Data Privacy Framework	Independent controller for identity services
Cloudflare, Inc., San Francisco, USA	DNS for our domains; forwards mail sent to our addresses to our mailbox (sender, recipient, message in transit). Our websites and API do not run through Cloudflare	Global network; USA	Processor under its DPA; SCCs and EU-U.S. Data Privacy Framework

Peer-to-Peer tier — current status

The Peer-to-Peer tier first uses spare EU capacity, with lower priority than EU-tier requests. When that capacity is busy, Peer-to-Peer requests may use on-demand GPU capacity rented through Lium (lium.io). Independent third-party providers operate the GPU hardware in various countries, including outside the EU/EEA. Processing outside the EU happens only for API keys whose customer has explicitly enabled the "Allow worldwide processing" switch. Without that opt-in, Peer-to-Peer requests stay on EU capacity and may be queued or rejected with a retryable error when busy. EU-tier requests always stay in the EU and have priority. Existing customers keep EU-only processing unless they opt in for the individual key. Request and response content is not stored on our gateway or our UpCloud inference servers; Lium GPU providers are third parties outside this commitment. The notice and objection process in DPA section 6.2 still applies to new content sub-processors. This list does not assert Lium certifications or signed Standard Contractual Clauses.

Network processing (separate opt-in per key). On keys with "Peer-to-peer network processing" enabled, eligible requests go first to the peer-to-peer network of independent providers (Bittensor subnet 92), worldwide, even when "Allow worldwide processing" is off. These providers see request content in clear text and are not bound to us by contract; no personal data may be sent on these keys. The terms are in the Peer-to-Peer Network Processing Addendum. The network's request router and the reference GPU used for sampled answer checks run on servers we rent from DataCrunch Oy (Verda) in Finland (EU); they handle content only of network-enabled keys. Because no personal data may be sent on these keys, these recipients are not listed in the table above (addendum section 4).

Change history

Date	Change
27 Sep 2026	First version
28 Sep 2026	Hetzner service scope and safeguard reference clarified; no provider added or removed
30 Sep 2026	Google sign-in and account-provider roles clarified; Hetzner data-centre location (Helsinki) and Scaleway status (not yet in use) stated; no provider added or removed
1 Oct 2026	Lium and independent third-party GPU providers added for opted-in Peer-to-Peer overflow; EU-only defaults, EU-tier priority, zero payload retention and transfer conditions clarified
2 Oct 2026	Resend added for optional email sign-in; US storage and transfer safeguards disclosed. API-content sub-processors, existing Google sign-in and billing paths unchanged.
6 Oct 2026	UpCloud Oy (Helsinki, data centre FI-HEL2) added as additional GPU capacity for EU-tier requests at peak load; EU-tier requests still stay in the EU. Added with effect from 6 Oct 2026 without the 30-day advance notice that applied at the time; existing customers were informed by email the same day. You may object in text form on reasonable data protection grounds until 5 Nov 2026; the rights in DPA section 6.2 otherwise apply, including termination with a refund of unused prepaid credit.
7 Oct 2026	UpCloud Oy (Helsinki, FI-HEL2), already listed since 6 Oct 2026, now hosts our always-on GPU for all tiers instead of DataCrunch Oy (Verda), which is being phased out in October 2026; no new sub-processor is added. EU-tier requests still stay in the EU; Peer-to-Peer requests without worldwide opt-in also stay in the EU.
9 Oct 2026	Verda (DataCrunch Oy) removed: the server was deleted on 9 October 2026 and Verda is no longer used for inference. Our always-on GPU inference capacity now runs at UpCloud (Helsinki, FI-HEL2), with opted-in Peer-to-Peer overflow via Lium as before. No new sub-processor is added.
21 Oct 2026	GPU Server Hub (Janusz Ciuruś / BESTCONNECT, 4DataCenter Katowice, Poland) announced as an additional GPU inference sub-processor for the EU tier and Peer-to-Peer/Global base capacity, effective 21 Nov 2026. EU-tier requests still stay in the EU. You may object in text form until the end of 20 Nov 2026 under DPA section 6.2.
23 Oct 2026	Corrections, no provider added or removed: certification entries for Hetzner and UpCloud now name the certificate we verified and its scope; the statement that Peer-to-Peer stays in the EU now also names the separate network-processing opt-in; the network-processing recipients (independent providers, and the Verda-hosted router and reference GPU) are described. The 9 Oct 2026 entry about Verda referred to EU and Peer-to-Peer inference capacity, not to the network router.
23 Oct 2026	GPU Server Hub (4DataCenter Katowice, Poland) in use since 23 Oct 2026 for EU-tier customers who agreed to this in writing in advance. For all other customers it starts on 21 Nov 2026 as announced, and the objection period until the end of 20 Nov 2026 is unchanged. No other provider added or removed.
28 Oct 2026	Correction, no provider added or removed: the UpCloud entry now names the renewed ISO/IEC 27001:2022 certificate No. 13851-03 (Kiwa, valid until 20 Oct 2029), which we verified, and states that it excludes the co-location data centres, including FI-HEL2; it also names the ISO/IEC 27001:2022 certificate No. 14821-02 of the FI-HEL2 operator Telia Finland Oyj (valid until 25 Sep 2027). Also on 28 Oct 2026: the advance notice for new content sub-processors follows DPA version 1.3 (7 days; 30 days for customers who accepted DPA version 1.2 or earlier and have not accepted version 1.3)
30 Oct 2026	UpCloud Oy, already listed, announced for additional EU data centres from 30 Nov 2026: FI-HEL1, SE-STO1, DK-CPH1, DE-FRA1, NL-AMS1, PL-WAW1 and ES-MAD1, in addition to FI-HEL2. No new provider is added, and EU-tier requests still stay in the EU. The entry names the data-centre certificates UpCloud sent us for all seven new data centres. You may object in text form until the end of 29 Nov 2026 under DPA section 6.2.
30 Oct 2026	Correction, no provider added or removed: the GPU Server Hub entry now names ISO/IEC 27001 certificate No. 4414/10/2026/BI/C of the Katowice data centre operator Quicktel Sp. z o.o. (Polska Akademia Jakości Cert, valid until 18 Oct 2029), which we checked.
5 Nov 2026	Email disclosures corrected: Resend's uses listed in full, including request mails, hosting notices, promotional-credit notices, top-up and withdrawal confirmations and first-contact business emails; Google's mailbox role and Cloudflare (DNS, mail forwarding) added to the list. All were already in use except promotional-credit notices (new) and top-up and withdrawal confirmations (sent through Resend since 4 Nov 2026). No API content goes to these providers from the Service.

Previous versions.