Legal
Sub-processors
Last updated: July 2026
OperonAI engages the following sub-processors to process personal data in connection with the Service. A sub-processor is a third-party data processor engaged by OperonAI who agrees to receive and process personal data on behalf of OperonAI's customers.
Changes to this list will be notified in accordance with the terms of the applicable Data Processing Agreement or Terms of Service.
Update owner: LLC "Aviant Core" — [email protected]
Sub-processors
| Sub-processor | Service | Purpose | Data location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc. | Supabase | Database hosting, authentication, edge functions, file storage, real-time features | AWS eu-west-1 (Ireland) | Standard Contractual Clauses |
| OpenAI, LLC | OpenAI API | AI/LLM processing — generating responses to user prompts | USA | Standard Contractual Clauses |
| Anthropic PBC | Anthropic API | AI/LLM processing — generating responses to user prompts | USA | Standard Contractual Clauses |
| Google LLC | Gemini API / Vertex AI | AI/LLM processing — generating responses to user prompts | USA / EU (configurable) | Standard Contractual Clauses |
| Microsoft Corporation | Azure OpenAI | AI/LLM processing — generating responses to user prompts | USA / EU (configurable) | Standard Contractual Clauses |
| Amazon Web Services, Inc. | Amazon Bedrock | AI/LLM processing — generating responses to user prompts | USA / EU (configurable) | Standard Contractual Clauses |
| OpenRouter | OpenRouter API | AI/LLM routing and processing — generating responses to user prompts | USA (default) | Standard Contractual Clauses |
| Resend Inc. | Resend | Email delivery — authentication, notification, and transactional emails | AWS us-east-1 (USA) | Standard Contractual Clauses |
| Google LLC | Firebase Cloud Messaging | Push notification delivery to mobile devices | USA / EU | Standard Contractual Clauses |
| PayPro Global Inc. | PayPro Global | Payment processing — subscriptions, billing, invoicing, and transaction handling | Canada / EU / USA | Standard Contractual Clauses |
| Oracle Corporation | Oracle Cloud Infrastructure | Web application and landing site hosting (self-managed VM) | USA | Standard Contractual Clauses |
Infrastructure and network services
The following services provide DNS resolution, traffic proxying, and SSL termination. They do not access or store personal data beyond standard network-level metadata.
| Provider | Service | Purpose |
|---|---|---|
| Cloudflare, Inc. | Cloudflare DNS / Proxy | DNS resolution, DDoS protection, SSL termination, traffic proxying |
| Internet Security Research Group | Let's Encrypt | SSL/TLS certificate issuance |
Notes
- AI providers: Organizations may configure their own API keys for any supported AI provider. When a customer brings their own key, the provider relationship may differ from the default arrangement described above.
- Google integrations (Drive, Calendar): These are user-authorized independent services. Google acts as an independent controller, not a sub-processor, for data processed through these integrations.
- Mobile app stores (Google Play, Apple App Store): App distribution platforms act as independent controllers for app downloads and related data.
- Changes: Sub-processors may be added or removed as the Service evolves. Registered customers will be notified of material changes in accordance with the applicable Data Processing Agreement.