Subprocessors register.

validant.ai uses a small number of carefully selected service providers (subprocessors) to operate the platform, deliver the services and run the business. This register lists every such provider that may have access to personal data we process, on behalf of our customers or for our own purposes, the purpose, the data categories, the location and the transfer mechanism in place. It is updated whenever the inventory changes.

Our customers are the controllers in respect of the data they upload to the platform. We engage subprocessors under GDPR Article 28(2) with prior general written authorisation, subject to the notification right below. For Swiss customers we apply the equivalent regime under revFADP Art. 9.

Effective as of the "Last updated" date at the top of this page.

We will notify active customers of any intended addition or replacement of a subprocessor at least 30 days before the new subprocessor starts processing personal data. Notification is sent to your nominated DPA contact and posted here. Customers may object on reasonable grounds; if we cannot accommodate the objection, the affected service may be terminated under the conditions of the DPA.

Subscribe to subprocessor change notices by writing to privacy [at] validant [dot] ai.

• The data processing terms that apply to each provider are named in the register above, in the transfer column
• Least-privilege scoping: each subprocessor only receives the data needed for the purpose
• Content the platform encrypts in your browser reaches the provider that stores it only in encrypted form, and that provider holds no key that decrypts it
• We review this register whenever we add, replace or stop using a provider