SUB-PROCESSORS

Who else processes your data.

A public list of every third-party service AI Twin uses to operate. What they do, where they process data, and whether we have a data processing agreement in place with each one.

Last updated 26 July 2026

Version 2.0. Effective 1 September 2026.

WHAT THIS IS

Transparency, not boilerplate.

Under UK GDPR Article 28, any service that processes personal data on our behalf is our “data processor”. This page lists every one of them, and below the table we also name the hosts your browser connects to directly, which are not processors. We update it when anything changes.

Each entry shows what the processor does, where in the world it processes data, and whether we have a written Data Processing Agreement (DPA) in place with them. Where a processor handles personal data, a DPA is legally required. Where it does not, a DPA is documented anyway as good practice.

THE LIST

Every category of sub-processor we use.

We publish the categories, what each one does, where it processes data and whether a data processing agreement is in place.

Sub-processor categories

  • Hosting and database

    Purpose
    Runs the application and stores your memory
    Region
    European Economic Area
    DPA Status
    in place

  • Model providers

    Purpose
    Runs the AI that classifies, searches and drafts
    Region
    European Union
    DPA Status
    in place

  • Speech to text

    Purpose
    Turns voice into text you review
    Region
    European Union
    DPA Status
    in place

  • Payments

    Purpose
    Takes subscription payments and issues receipts
    Region
    United Kingdom and European Union
    DPA Status
    in place

  • Email delivery

    Purpose
    Sends confirmations, replies and newsletters
    Region
    European Union
    DPA Status
    in place

  • Error monitoring

    Purpose
    Tells us when something breaks
    Region
    European Union
    DPA Status
    in place

  • Edge network and DNS

    Purpose
    Delivers the site and protects it from attack
    Region
    Global edge network with EU residency
    DPA Status
    in place

  • Website analytics

    Purpose
    Counts page views, no cookies, no identity
    Region
    European Union
    DPA Status
    in place

  • Application hosting and build tooling

    Purpose
    Builds and serves this website, and records aggregate page views
    Region
    To be confirmed
    DPA Status
    in progress

  • Contextual lookups

    Purpose
    Weather and locale at onboarding
    Region
    To be confirmed
    DPA Status
    in progress

Where a provider’s standard data processing terms form part of the agreement we accepted at signup, we say the agreement is in place. Where an agreement is still being sought, we say that too, rather than implying paperwork that does not exist.

STATIC ASSET HOSTS

Where the homepage demo files come from.

The on-device demo on our homepage uses two static file hosts to deliver the embedding model and runtime to your browser. These are not sub-processors of your personal data, they never see your queries or anything you type, but because your browser fetches these files directly, both receive your IP address and standard request headers in the same way any website you visit does. We describe them here for transparency.

  • Machine-learning model host

    What they host
    The embedding model (Xenova/all-MiniLM-L6-v2), about 24MB across four model files
    Region
    United States (CDN distributed) (large files may be served via cas-bridge.xethub.hf.co)
    What they see
    Your IP address and request headers, and that a public model file was downloaded

  • Open-source package CDN

    What they host
    The ONNX runtime WebAssembly files, about 24MB across two runtime files
    Region
    Distributed CDN (region varies)
    What they see
    Your IP address and request headers, and that public runtime files were downloaded

These hosts apply only to the homepage demo. The full AI Twin product (when you sign in) uses the sub-processor list above and does not download files from these CDNs. If we add or change a sub-processor, we will update this page and tell our newsletter subscribers.

REQUESTS

If you want the underlying paperwork.

Business customers who need provider-level detail for their own data protection agreement can ask us at hello@ai-twin.co.uk.

CHANGES

When we update sub-processors.

We update this page when we add, remove, or change a sub-processor. If you are on our newsletter, we email you about material changes (a new processor, or a change in processing region for an existing processor) before the change takes effect. For visitors to the site, the updated list applies from the date it is published here.

Change log

  • 1 September 2026. Rewritten for launch. Company details, tax position, subscription terms and complaints route added.

AI Twin Limited is a private company registered in Scotland, company number SC866947. Registered office: 272 Bath Street, Glasgow, G2 4JR. Registered with the Information Commissioner's Office, registration ZC044489.