> ## Documentation Index > Fetch the complete documentation index at: https://docs.niadra.com/llms.txt > Use this file to discover all available pages before exploring further. # Subprocessors > Who processes customer data on Niadra's behalf, for what, what they receive, where and on what contractual basis. Checked against the code and the configuration on 30/09/2026. A subprocessor is a third party that processes your company's customers' data on Niadra's behalf. The list below is the same one attached to the data processing agreement (DPA), and every row was checked against the server's code (`niadra-back`) and the cloud template (`niadra-infra/aws/cluster.yaml`): nothing is here without being in use, and nothing in use is missing. The list changes by contract. A new subprocessor enters this page and the annex before it receives any data, and the contract states the notice period and your company's right to object. ## The subprocessors | Subprocessor | For what | What it receives | Where | Contractual basis | | - | - | - | - | - | | **Amazon Web Services** (EC2, RDS PostgreSQL, S3, KMS, Secrets Manager, SNS, CloudWatch Logs, ECR, Route 53, SES) | The cloud Niadra runs on: the machine, the database, object storage, the master key, the secret store, alerts, logs, the services' images, DNS and the control plane's e-mail | All the memory, encrypted at rest by the cloud and, for the content of conversations, facts and context, a second time by the application (AES-256-GCM, one key per space). Logs carry no content. E-mail carries the customer's data protection officer's address and a code or a notice, never end-customer data | `us-east-2` (Ohio, United States). Every Niadra data region is an AWS region, and the contract names your company's | AWS service terms, with the AWS Data Processing Addendum that is part of them; AWS publishes the ISO 27001, SOC 2 and PCI DSS certifications of the services used | | **OpenRouter** | The router through which Niadra calls the two AI models. Every request carries `data_collection: deny` (the final provider may not keep the request for training or improvement) and `zdr: true` (zero-retention routes only) | The text of conversations, already masked (e-mail, phone, card, IBAN, address, documents and bank accounts replaced by placeholders inside the cell), and the event samples the configuration assistant reads | Outside the data region; OpenRouter fixes no region | OpenRouter's terms of use; the zero-retention policy and the refusal of data collection are requested on every call, in the code (`niadra-back/src/niadra/adapters/outbound/llm/openrouter.py` and `jev.py`). There is no negotiated contract | | **OpenAI** (model GPT-6 Luna, `openai/gpt-6-luna`) | The generation model: extracts facts, open items, promises, values and the outcome of each conversation, writes the configuration assistant's proposals and distils the agents' working notes | The same masked text and the same samples, through OpenRouter | Outside the data region, with no fixed region | Through OpenRouter, under the route's zero-retention policy; there is no direct contract between Niadra and OpenAI | | **TypeSafe** (model Jev, `typesafe/jev-1.13`) | The decision model: answers whether a conversation is worth extracting, whether a turn tries to instruct the agent, the sensitive category of a text, the type of an agent's question and whether two claims contradict each other. Returns labels and probabilities, never text | The masked text, as for extraction | Outside the data region; the vendor publishes neither its own processing region nor its own retention period | Through OpenRouter, with zero retention requested on every call; there is no direct contract | On e-mail: Niadra sends e-mail through Amazon SES, in `us-east-2`, only from the control plane (the code to decide an approval request, the notice of a request to the customer's data protection officer and the notice of an emergency access). The `niadra.com` domain is verified in SES; the account is still in the SES sandbox, in which the service only delivers to verified addresses, so until production access is granted Niadra verifies each officer's address before using it. ## What runs inside the region, with no third party * The rule-based masking and the personal-data detector that prepare the text before the model (`niadra-back/src/niadra/domain/extract/redaction.py` and the cell's models server, `niadra-back/models/`). * The semantic search model (embeddings) and the reading of text in PDFs, images and office documents: no customer file reaches a third party (`niadra-back/src/niadra/adapters/outbound/media_text.py`). * The context read: no model is called when the agent asks for context. ## Who is not a subprocessor Third parties Niadra uses that do not process customer data: | Third party | Use | Why it does not process customer data | | - | - | - | | GitHub | Code, pull requests and CI | The repositories hold no customer data and no cloud credential; CI runs on synthetic data and nothing in it deploys | | Mintlify | Hosts this documentation (`docs.niadra.com`) | Public pages only; no memory data passes through here | | Let's Encrypt | TLS certificates of Niadra's hosts | Receives only the host names | | Your company's identity provider (OIDC or SAML) | Your people's sign-in to the Console | It is yours, not Niadra's; Niadra receives the identity and the groups it sends | | Your endpoints: webhooks, SIEM, export bucket | Destinations of deliveries and continuous export | They are yours; Niadra writes to them and never reads from them | ## How to check The requests to the models and the `provider` each one carries are in `niadra-back/src/niadra/adapters/outbound/llm/`. The AWS services are in the template `niadra-infra/aws/cluster.yaml` and in `niadra-infra/README.md`. The site publishes the same list at [niadra.com/en/recursos](https://niadra.com/en/recursos#subprocessadores). A customer under a non-disclosure agreement can read both repositories. ## Next steps what Niadra does and does not do with the data. the boundary with the AI models and its residual risk.