Sub-processors
DPA Annex A · Last updated: 18.2.2026
This page lists all third parties that process data via the Arctura Service. Sovereignty Switch: In EU mode, AI processing uses only EU-based models (Mistral, Aleph Alpha). See the Data Processing Agreement (DPA).
Current list
| Sub-processor | Location | Purpose | Data type |
|---|---|---|---|
| Google Cloud Platform | 🇫🇮 Hamina, Finland (europe-north1) | GKE (Web + Engine), BigQuery, DLP, Secret Manager | Telemetry, analytics, request logs |
| Supabase | 🇮🇪 Ireland (EU-West-1) | PostgreSQL, Auth, Realtime | Users, fleet_snapshot |
| Stripe | 🇮🇪 Ireland (Stripe Payments Europe) | Payment processing, subscription management | Billing email, customer ID |
| Resend | ⚠️ Verify EU/USA (DPF) | Transactional email | Name, email, message |
| Google AI (Gemini) | 🇺🇸 / 🇪🇺 | LLM: fleet analytics, alert reports (Global mode) | Limited telemetry (device, location, speed) |
| Anthropic (Claude) | 🇺🇸 | LLM: fleet analytics, Päätösyksikkö (Global mode) | Limited telemetry |
| x.ai (Grok) | 🇺🇸 | LLM: fleet analytics (Global mode) | Limited telemetry |
| OpenRouter (Mistral, Grok, Claude, Gemini) | 🇪🇺 / 🇺🇸 | LLM: Quant, ESG, EU Enforcement (Mistral) | Limited telemetry |
| Aleph Alpha | 🇩🇪 Germany | LLM: Päätösyksikkö EU mode — data stays in Europe | Limited telemetry |
Change log
| Date | Change |
|---|---|
| 18.2.2026 | DPA v1 Annex A: GCP Hamina, Supabase EU-West-1, Stripe Ireland, Resend ⚠️ verify |
| 16.2.2026 | Sovereignty Switch: EU mode added. Aleph Alpha, OpenRouter/Mistral as EU LLMs. |
| 16.2.2026 | Initial list: GCP, Supabase, Stripe, Resend, Gemini, Anthropic, x.ai |
| 16.2.2026 | Vercel removed (web moved to GKE) |
Change notice
New sub-processors will be notified at least 30 days before onboarding (by email and/or via the Service). The Customer has the right to object on reasonable grounds within 14 days.
NeurFlow Oy · Business ID: 3597951-1 · Helsinki, Finland
Inquiries: legal@neurflow.fi