Sub-processors

Last updated: 21 October 2026

These are the companies that process personal data on behalf of Enqualia to provide the Service. The list is part of our data processing agreement and our privacy policy.

1.Current list

When says when a provider receives data: some only when you use a particular feature or choose a particular model.

Sub-processors of Enqualia
  • Google Cloud
    Always
    What for
    Hosting the platform: servers (Cloud Run), database (Firestore), file storage, secrets, background jobs, logs and usage records (BigQuery); AI models on Vertex AI (Gemini, Mistral Medium, embeddings), web search, translation and speech recognition; maps (Google Maps Platform) in APIs that look up places and routes.
    Data
    All data in the platform, including the workspace content sent to the models.
    Where
    EU: Belgium (europe-west1) and the Netherlands; Gemini Flash models on Google's EU endpoint. Outside the EU: Gemini models without an EU endpoint, server logs, and a copy of the usage records, without content, in the United States.
    Safeguard
    Google Cloud data processing terms with Standard Contractual Clauses; Data Privacy Framework.
  • Firebase (Google)
    Always
    What for
    Signing in (Authentication), hosting the website (Hosting) and delivering push notifications (Cloud Messaging).
    Data
    E-mail address, name, user id, sign-in method and IP address; device push tokens and the text of notifications.
    Where
    United States and Google's global network.
    Safeguard
    Google Cloud data processing terms with Standard Contractual Clauses; Data Privacy Framework.
  • Google Gemini API (Google AI Studio)
    When you use the feature
    What for
    Live voice (Gemini Live), reading answers aloud and generating images.
    Data
    Voice audio during a session (not stored), the text to read aloud, prompts and images.
    Where
    Outside the EU (Google's global infrastructure).
    Safeguard
    Google's terms for the paid Gemini API, with Standard Contractual Clauses; Data Privacy Framework.
  • Anthropic
    With the default model setting
    What for
    Claude models: planning, reviewing, writing and most of the work under Qualia's choice (the platform default) or a chosen Claude model; the coding engine of the Workbench.
    Data
    The request, the workspace content a task needs, and the result.
    Where
    United States.
    Safeguard
    Anthropic's data processing addendum with Standard Contractual Clauses.
  • Mistral AI
    Only when chosen
    What for
    Mistral Large models through Mistral AI's own API, when a project chooses one, and the APIs we build on Mistral AI for a customer who asks for it (reading documents and search embeddings).
    Data
    The request, the workspace content a task needs, and the result.
    Where
    EU.
    Safeguard
    Processing in the EU under Mistral AI's data processing agreement.
  • Stripe
    When you pay
    What for
    Payments, subscriptions, invoices, VAT calculation and the billing portal.
    Data
    Name, e-mail address, billing address, VAT number, payment method and payment history.
    Where
    EU (Ireland) and United States.
    Safeguard
    Stripe's data processing agreement with Standard Contractual Clauses; Data Privacy Framework.
  • Apple Push Notification service
    When you use the feature
    What for
    Delivering push notifications to iPhones and iPads.
    Data
    The device's push token and the notification's title and text.
    Where
    United States.
    Safeguard
    Apple's developer terms; Standard Contractual Clauses or the Data Privacy Framework.
  • Firebase Crashlytics (Google)
    In the mobile app · Arrives with an update that is being rolled out
    What for
    Crash and error reports from the mobile app.
    Data
    The error, a scrubbed message and stack trace, device model, operating system, app version and a per-install id; no user id.
    Where
    United States.
    Safeguard
    Google Cloud data processing terms with Standard Contractual Clauses; Data Privacy Framework.
  • Sentry
    Only when switched on
    What for
    Error reports from the website and our servers, only while switched on.
    Data
    The error, the page or request, browser and user id; on the website a replay of the moments before the error with all text masked and media blocked. Keys and tokens are removed.
    Where
    EU data region (Germany); Sentry is a company in the United States.
    Safeguard
    Sentry's data processing addendum with Standard Contractual Clauses; Data Privacy Framework.
  • Cal.com
    When you use the feature
    What for
    The demo calendar on the onboarding page.
    Data
    Name, e-mail address, the chosen time and any note you add.
    Where
    United States.
    Safeguard
    Cal.com's data processing agreement with Standard Contractual Clauses.
  • TypeSafe
    Only when switched on
    What for
    An optional service that answers small yes-or-no and multiple-choice questions for Qualia's search. Off by default; never used for EU-only organisations or projects with an EU model.
    Data
    A short summary of the task at hand (at most 6,000 characters).
    Where
    United States.
    Safeguard
    Standard Contractual Clauses.
  • ImageRouter
    Only when chosen
    What for
    Image models it hosts, such as SDXL Turbo and FLUX, only when an image API is asked to use one of them.
    Data
    The text prompt for the image.
    Where
    ImageRouter's processing location: to be confirmed
    Safeguard
    Safeguard: to be confirmed with ImageRouter
  • GitHub
    Only when switched on
    What for
    Storing the code the Workbench writes, for projects where the Workbench is switched on.
    Data
    Code and files of the website or script being built, and commit messages.
    Where
    United States.
    Safeguard
    GitHub's data protection agreement with Standard Contractual Clauses; Data Privacy Framework.

2.Services you connect

These services are not our sub-processors: a project owner chooses to connect them, and they act for the customer under their own terms. We list them so you know where data can go.

Services a project can connect
  • Gmail, Microsoft 365, Zoho Mail, IMAP and SMTP

    Reads messages to answer questions, saves drafts and sends mail a project owner confirms. Keeps the newest items per folder and alerts, as the privacy policy describes.

  • Google Drive
    Arrives with an update that is being rolled out

    Copies the files you pick into private storage of the project in the EU and keeps them up to date.

  • Microsoft Dynamics 365

    Reads records live, read-only.

  • Firestore, DynamoDB, PostgreSQL, MySQL, MongoDB

    Reads and writes on request, with the credentials the project owner entered.

  • Google Cloud Storage, Amazon S3 and S3-compatible storage, Azure Blob Storage

    Reads and writes files on request.

  • Google Cloud, Amazon Web Services, Microsoft Azure

    Uses the credentials for your own cloud account for the storage and services you set up there.

  • Slack, Microsoft Teams, webhooks

    Sends alert text to the address you configure.

  • HTTP APIs you add

    Calls the API with your credentials when Qualia fetches data for you.

  • Sign in with Google, Microsoft or Apple

    Receives your identity and profile at sign-in; for Microsoft work accounts also your work profile, your organisation's tenant and your Enqualia app roles (the privacy policy lists each field).

3.Content from other sites

Some pages load content from other services, which then receive your IP address: Cal.com (the demo calendar), YouTube (videos in the reader, through youtube-nocookie.com), OpenStreetMap (map tiles) and the code libraries unpkg.com and jsDelivr. See Cookies and storage in your browser.

4.Changes

We announce a new or replaced sub-processor at least 30 days before it starts, on this page and by e-mail to project owners. Customers can object as described in the data processing agreement. Questions: support@enqualia.io.