Sub-processors
Data processing agreement addendum · Carbonifer SAS · generated from the provider catalogue
Carbonifer SAS ("we") operates Lowrouter as a processor for the content of the requests our customers send through the API. This page lists every third party that may process personal data on our behalf, split into the vendors that run the platform and the AI providers a request can be routed to. It is the list referred to by our Privacy Policy and by our Data Processing Agreement.
1. How routing works
A request is forwarded to one AI provider at a time: the one you name in the request, or the one our routing selects within the constraints you set (provider allow-list, sovereignty facet, hosting region). If that provider fails before returning a response, automatic routing may retry the same request with the next eligible provider under the same constraints. No AI provider receives your request unless it is eligible under those constraints. We do not retain prompts or completions once the response has been returned, except where strictly necessary for security, abuse prevention or legal compliance as described in our Privacy Policy; the provider that served the request handles it under its own terms. We keep per-request metadata — timestamps, model and provider identifiers, region, token counts, cost, latency and the estimated energy and carbon footprint — for billing and usage reporting, for no longer than the retention period stated in the Privacy Policy.
2. Platform sub-processors
| Sub-processor | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| OVH SAS (OVHcloud) | Hosting: compute (Managed Kubernetes), managed PostgreSQL, object storage for platform logs | Account, billing and usage records; request metadata | France (Gravelines) | None — EU processing |
| Scaleway SAS | Object storage for database backups, transactional email (TEM) | Account, billing and usage records; request metadata; notification emails | France (Paris region) | None — EU processing |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing | Billing identity, payment instrument, invoices | Ireland (EU); Stripe group entities in the United States for card processing | Stripe's Standard Contractual Clauses and EU-US Data Privacy Framework certification |
| Termly, Inc. | Cookie consent management and hosted delivery of legal policies | Consent records and the IP address of website visitors | United States | Standard Contractual Clauses |
| Plausible Insights OÜ | Cookieless, aggregate website analytics on the production website only | Page paths and anonymous aggregate visit counts; no cookies, no identifiers | Estonia (EU), hosted in Germany | None — EU processing |
| Crisp IM SARL | Support chat widget on the production website and dashboard | Chat transcripts, the name and email address you give in the chat, IP address and page visited | France (EU) | None — EU processing |
| Tally BV | Waitlist sign-up form shown while self-service registration is closed | Email address and the answers you submit in the form | Belgium (EU) | None — EU processing |
3. AI providers (request content)
Each provider below is a sub-processor for the content of the requests routed to it. Legal jurisdiction is the country whose law controls the provider entity, which is not always where it is headquartered or where it hosts. EU-sovereign means the provider is established under EU law and not subject to US legal reach. CLOUD Act marks whether the provider entity (or its parent) can be compelled under the US CLOUD Act, regardless of hosting region — an EU region of a US-controlled provider is still exposed. Hosting regions are the regions the provider offers, as ISO 3166 country codes (EU and UK denote the bloc) spelled out in the legend under the table. Transfers to providers outside the EU/EEA rely on Standard Contractual Clauses or the provider's own EU-approved transfer mechanism.
| Provider | Headquarters | Legal jurisdiction | EU-sovereign | CLOUD Act | Hosting regions offered |
|---|---|---|---|---|---|
| AKI.IO | Berlin, Germany | Germany (DE) | Yes | Not exposed | EU |
| Anthropic | San Francisco, CA, United States | United States (US) | No | Exposed | US, EU, AU |
| AWS Bedrock | Seattle, WA, United States | United States (US) | No | Exposed | US, EU, UK, CA, JP, AU, KR, SG, BR, IN |
| Berget AI | Stockholm, Sweden | Sweden (SE) | Yes | Not exposed | EU |
| DeepInfra | San Jose, CA, United States | United States (US) | No | Exposed | US |
| evroc | Stockholm, Sweden | Sweden (SE) | Yes | Not exposed | SE |
| Mountain View, CA, United States | United States (US) | No | Exposed | US, EU, UK, JP, AU, KR, BR, SG, CH | |
| GreenPT | Utrecht, Netherlands | Netherlands (NL) | Yes | Not exposed | EU |
| Groq | Mountain View, CA, United States | United States (US) | No | Exposed | US, EU, CA, AU |
| Inceptron | Lund, Sweden | Sweden (SE) | Yes | Not exposed | FI |
| Infercom | Luxembourg City, Luxembourg | Luxembourg (LU) | Yes | Not exposed | EU |
| Infomaniak | Geneva, Switzerland | Switzerland (CH) | No | Not exposed | CH |
| IONOS | Montabaur, Germany | Germany (DE) | Yes | Not exposed | DE |
| Meta | Menlo Park, CA, United States | United States (US) | No | Exposed | US |
| Mistral AI | Paris, France | France (FR) | Yes | Not exposed | EU |
| Nebius | Amsterdam, Netherlands | Netherlands (NL) | Yes | Not exposed | EU |
| Nscale | London, United Kingdom | United Kingdom (GB) | No | Exposed | NO |
| OpenAI | San Francisco, CA, United States | United States (US) | No | Exposed | US, EU, UK, JP, CA, KR, SG, AU |
| OVHcloud | Roubaix, France | France (FR) | No | Exposed | FR |
| Regolo.ai | Frosinone, Italy | Italy (IT) | Yes | Not exposed | EU |
| Scaleway | Paris, France | France (FR) | Yes | Not exposed | EU |
| TensorX | Dublin, Ireland | Ireland (IE) | Yes | Not exposed | IE, FI |
| Vertex AI | Mountain View, CA, United States | United States (US) | No | Exposed | US, EU, UK, JP, AU, KR, BR, SG, CH |
Region codes: AU = Australia · BR = Brazil · CA = Canada · CH = Switzerland · DE = Germany · EU = European Union (any member state) · FI = Finland · FR = France · IE = Ireland · IN = India · JP = Japan · KR = South Korea · NO = Norway · SE = Sweden · SG = Singapore · UK = United Kingdom · US = United States.
23 providers listed: every provider this service can route a request to. The jurisdiction, sovereignty and region attributes are the same data that drive the provider catalogue and the sovereignty filters in the model browser, so they cannot disagree with the product. The catalogue additionally describes Azure OpenAI, Cohere, Fireworks AI, Perplexity, Replicate, Together AI, Verda — providers this service cannot route a request to, so they are not sub-processors and are deliberately not listed above.
4. Changes to this list
We will update this page at least 30 days before adding a new sub-processor or materially changing the role, location or transfer mechanism of an existing one. Customers with a Data Processing Agreement may object in writing within that period as set out in the agreement; if we cannot address the objection, the customer may terminate the affected service. Removals and corrections take effect immediately.
5. Data Processing Agreement
A Data Processing Agreement under Article 28(3) GDPR, incorporating this list by reference, is available on request at support@lowrouter.ai.