Subprocessors register.

validant.ai uses a small number of carefully selected service providers (subprocessors) to operate the platform, deliver the services and run the business. This register lists every such provider that may have access to personal data we process on behalf of our customers, the purpose, the data categories, the location and the transfer mechanism in place. It is updated whenever the inventory changes.

Our customers are the controllers in respect of the data they upload to the platform. We engage subprocessors under GDPR Article 28(2) with prior general written authorisation, subject to the notification right below. For Swiss customers we apply the equivalent regime under revFADP Art. 9.

Effective as of the "Last updated" date at the top of this page.

We will notify active customers of any intended addition or replacement of a subprocessor at least 30 days before the new subprocessor starts processing personal data. Notification is sent to your nominated DPA contact and posted here. Customers may object on reasonable grounds; if we cannot accommodate the objection, the affected service may be terminated under the conditions of the DPA.

Subscribe to subprocessor change notices by writing to privacy [at] validant [dot] ai.

• Written data processing agreement mirroring Art. 28 GDPR and Art. 9 revFADP obligations, signed before any data is shared
• Documented transfer impact assessment when data leaves Switzerland or the EU/EEA
• Security questionnaire and review of the subprocessor's certifications (ISO 27001, SOC 2 Type II, ISAE 3402) at onboarding and at each contract renewal
• Least-privilege scoping: each subprocessor only receives the data needed for the purpose
• Cryptographic isolation where the subprocessor cannot see the plaintext (e.g. customer-managed keys)
• Annual audit of access logs and policy compliance