These vendors may process Customer Data to deliver Rahoto. The same list is published in the legal sub-processor schedule that the Data Processing Agreement refers to.
| Vendor | What it does | Data it receives | Location |
|---|---|---|---|
| Hetzner Online GmbH | Application servers and database hosting | All Customer Data at rest in the database | EU (Helsinki, Finland) |
| Cloudflare, Inc. | File storage (R2) for report assets, exports, snapshots and database backups; asset delivery; DNS | Report assets, exports, snapshots and database backups | As set in the Cloudflare contract |
| Resend | Account, verification and delivery-notification email | Recipient email address and message content | As set in the Resend contract |
| Stripe | Subscription billing and payment processing | Billing contact, billing address and payment details | EU / US (SCCs) |
| Sign in with Google; Gemini API as a configured AI provider | Sign-in: name and email. Gemini: Your prompt, plus your data’s structure and aggregate profiles, never raw dataset rows. Names, addresses, emails and phone, card, bank account and national ID numbers are pseudonymised first. Scans and audio you send for transcription are processed as submitted. Not used for training under the provider’s API terms. | EU / US (SCCs) | |
| Microsoft | Sign in with Microsoft | Name and email address | As set in the Microsoft contract |
| Anthropic | Claude API, a configured AI provider for report drafting and reasoning | Your prompt, plus your data’s structure and aggregate profiles, never raw dataset rows. Names, addresses, emails and phone, card, bank account and national ID numbers are pseudonymised first. Scans and audio you send for transcription are processed as submitted. Not used for training under the provider’s API terms. | US (SCCs) |
| OpenAI | OpenAI API, a configured AI provider | Your prompt, plus your data’s structure and aggregate profiles, never raw dataset rows. Names, addresses, emails and phone, card, bank account and national ID numbers are pseudonymised first. Scans and audio you send for transcription are processed as submitted. Not used for training under the provider’s API terms. | US (SCCs) |
| TypeSafe | Advisory check that cited sentences in an AI draft agree with their sources | Sentences from report drafts and the claims they cite | As set in the TypeSafe contract |
| Recraft | Editable vector artwork generation, when enabled | The artwork prompt and redacted design context, never customer datasets | Confirmed in contract before activation |
AI model providers
Which configured provider handles a request depends on the task, the deployment's configuration, provider health and your organisation's policy. Whichever it is, what leaves Rahoto is the same restricted input: your prompt and the structure and aggregate profiles of your data, never raw rows, with personal details such as names, addresses, emails and phone, card, bank account and national ID numbers pseudonymised. Scans and audio you send for transcription are processed as submitted. Your organisation can also require that confidential data never reaches a cloud model at all. See how Rahoto handles your data with AI.
An AI model endpoint that your organisation configures itself is your vendor, not a Rahoto sub-processor.
Our commitments
- At least 30 days' notice before a new sub-processor handles Customer Data.
- You may object to a new sub-processor; we will work with you on an alternative or you may end the contract.
- When a vendor is removed, we stop sending it data and request deletion under our agreement with it.
Get notified of changes
Email [email protected] with the subject "Sub-processor notifications". Enterprise customers are notified through their designated security contact.