Subprocessors
Version 1.3 · last updated 5 October 2026
This list names the third-party providers Uprelic GmbH engages to provide Strom, Uprelic's decision API, together with what each one does, which data it handles, where, and under which transfer safeguard. It forms part of the Data Processing Agreement (the "DPA"), § 8.
Where your content goes
Requests are processed on GPU servers in the EU, operated for Uprelic by one GPU cloud provider, Scaleway, in its data centres in France. The servers run the API, the database and the Strom model (Uprelic's own, fine-tuned from open model weights) and have no route to the internet.
Only one provider handles the content of your requests: the GPU cloud provider (Scaleway), in the EU. All traffic reaches the servers through Scaleway's load balancer in France, where TLS ends, and our encrypted backups are stored with Scaleway in the Netherlands.
The other providers never receive request content; they handle account, sign-in and billing data only.
No AI model providers. No third-party AI model provider receives your requests, images or responses.
No analytics providers. We use no analytics, advertising or tracking services.
GPU cloud provider
| Item | Scaleway |
|---|---|
| Name and entity | Scaleway SAS (France), under its Data Processing Agreement (French law) |
| Website | scaleway.com |
| Purpose | Running the Strom API, database and model; load balancer in front of the servers (TLS termination); object storage for encrypted backups |
| Data involved | All account and request data at rest and in processing, including request content; all traffic to the Service in transit, unencrypted at the load balancer where TLS ends; IP addresses and connection metadata; encrypted backups of the whole database (encrypted by Uprelic before upload) |
| Location | Servers and load balancer: data centres in France (EU). Backups: Amsterdam, Netherlands (EU) |
| Transfer safeguard | Not required (EU) |
Amazon Web Services (Amazon SES)
| Item | Details |
|---|---|
| Name and entity | Amazon Web Services EMEA SARL |
| Website | aws.amazon.com |
| Purpose | Sending sign-in emails (magic links), the welcome email and notices about the account, such as a low balance |
| Data involved | Email address and the content of these emails |
| Receives request content | No |
| Location | Amazon SES region eu-central-1 (Frankfurt, Germany) |
| Transfer safeguard | EU region; for any access from outside the EEA, the EU Standard Contractual Clauses in the AWS DPA; AWS is also DPF-certified |
Stripe
| Item | Details |
|---|---|
| Name and entity | Stripe Payments Europe, Ltd. (Ireland) |
| Website | stripe.com |
| Purpose | Payments for prepaid top-ups, invoices, tax calculation, customer portal |
| Data involved | Billing details, payment details, tax ID where given, invoices, Stripe customer ID |
| Receives request content | No |
| Location | Contracting entity in Ireland (EU); also the USA and other countries where Stripe operates |
| Transfer safeguard | EU–US Data Privacy Framework and EU Standard Contractual Clauses (Stripe Data Transfers Addendum) |
| Note | Stripe is an independent controller for fraud prevention, risk and regulatory compliance |
Google (only with Google sign-in)
| Item | Details |
|---|---|
| Name and entity | Google Ireland Limited / Google LLC — an independent controller, not our processor |
| Website | google.com |
| Purpose | Sign-in to the console with a Google account |
| Data involved | The data exchanged for sign-in, such as your email address and Google account identifier |
| Receives request content | No |
| Location | Google's global data centres, including the USA |
| Transfer safeguard | EU–US Data Privacy Framework and EU Standard Contractual Clauses (Google Controller-Controller Data Protection Terms) |
Not on this list
- Our own components. The API, the database and the Strom model are Uprelic's own systems on the servers operated for us, not services of a third party.
- The IP geolocation database. We look up a visitor's country in a database file from DB-IP that is stored on our servers. No data is sent to DB-IP.
- Our DNS provider. It answers lookups for our domain names and never receives your traffic or data.
- Image hosts you point us to. When you reference an image by URL, we download it from that address on your instruction. The operator of the address is not our subprocessor.
- AI model providers and analytics providers. We use none.
Changes to this list
We announce any new or replacement subprocessor at least 30 days before it takes effect, by email to the address of your account and by publishing the change, with its effective date, on this page. You can object before the change takes effect, as described in § 8 of the DPA. Every version of this list carries a version number and a date.
Questions
Questions about this list: privacy@uprelic.com.