Sub-processors
Last updated: 2026-07-17
In plain English: these are the outside companies that touch your data, and what each one does. If we add one, you get 30 days' notice first.
Per GDPR Article 28, the following third parties may process personal data on our behalf. We only share the minimum data needed for each purpose.
Platform pool (we call these with our key, on your behalf)
When you spend wallet credit on a platform-pool model, we send your prompt to the provider that runs that model using our API key. Each provider below is our sub-processor for that request. Which providers are live depends on which platform keys are configured; the list here covers every provider we hold a key for.
Knockout fc: refs route directly to the named vendor (Anthropic, OpenAI, Google, Mistral, DeepSeek, xAI) when we hold a key for it, and fall back to OpenRouter otherwise. Ringside has no bring-your-own-key path: every Ringside call runs through the platform pool, so every provider below is a sub-processor for your Ringside traffic.
| Name | Purpose | Location | DPA |
|---|---|---|---|
| OpenRouter, Inc. | LLM gateway. Fallback route for any model where we do not hold a direct provider key. | US transfers under SCC | link |
| OpenAI, L.L.C. | Chat/completion models, moderation, audio transcription and speech, image generation. | US transfers under SCC (EU processing available) | link |
| Anthropic PBC | Claude chat/completion models (direct-to-vendor when a platform key is set). | US transfers under SCC (EU region available) | Provider-specific |
| Google LLC (Gemini API) | Gemini chat/completion models via the Generative Language API. | US transfers under SCC (EU region available) | link |
| Google Cloud (Vertex AI) | Region-pinned model inference for residency routing. | US default; EU regions available under SCC | link |
| Amazon Web Services (Bedrock) | Region-pinned model inference for residency routing. | US default; EU regions available under SCC | Provider-specific |
| Mistral AI | Mistral chat/completion models (direct-to-vendor when a platform key is set). | France (EU) | Provider-specific |
| DeepSeek | DeepSeek V4 chat/completion models (direct-to-vendor when a platform key is set). | China (non-adequate; transfers under SCC + supplementary measures) | Provider-specific |
| xAI Corp. | Grok chat/completion models (direct-to-vendor when a platform key is set). | US transfers under SCC | Provider-specific |
| Groq, Inc. | Fast chat/completion inference and Whisper audio transcription (receives the raw audio file). | US transfers under SCC | Provider-specific |
| Stability AI | Image generation. | US transfers under SCC | Provider-specific |
| Replicate, Inc. | Image generation and hosted model inference. | US transfers under SCC | Provider-specific |
| ElevenLabs Inc. | Text-to-speech audio generation. | US transfers under SCC | Provider-specific |
| Cohere Inc. | Rerank / embeddings. Platform key held and wired; not dispatching live traffic yet. Listed ahead of first use. | US / Canada (adequacy) transfers under SCC | Provider-specific |
| Voyage AI | Embeddings. Platform key held and wired; not dispatching live traffic yet. Listed ahead of first use. | US transfers under SCC | Provider-specific |
Infrastructure & operations
| Name | Purpose | Location | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting. Primary database and application servers in Germany (Falkenstein). | Germany (EU) | link |
| Stripe Payments Europe, Ltd. | Card payments, subscription billing. | Ireland (EU) + US transfers under SCC | link |
| Resend (Plus One Labs, Inc.) | Transactional email delivery. | US transfers under SCC | link |
| OVH SAS | Off-site database backups. The nightly database dump is AES-256 encrypted on our server before it is uploaded, so OVH holds ciphertext only. | France (EU) | link |
| Let's Encrypt (ISRG) | TLS certificate issuance. | US (no personal data transferred) | N/A |
Bring-your-own-key (BYOK)
On Knockout, a user: ref or an organisation key sends your prompt to the provider you chose using your credentials, not ours. In that case the provider is your own processor under your agreement with them, and their privacy policy applies. We don't hold that relationship, so those providers are not our sub-processors. This BYOK path does not exist on Ringside.
We notify customers of new sub-processors at least 30 days before they start processing personal data. Email privacy@fightclub.pro to subscribe to sub-processor change notifications.