Sub-processors
Last updated · June 2026Atlas uses a small set of vetted sub-processors to run the service. Each is bound by data-protection terms equivalent to our DPA. We give at least 30 days’ notice before adding or replacing one, and you may object on reasonable grounds. To be notified of changes, email atlas@arthea.ai.
01Infrastructure and data
Neon (Postgres database). Data: all tenant data. Region: EU (Frankfurt).
Google Cloud, Cloud Run (durable worker pool). Data: job payloads (tenant data). Region: EU (europe-west3).
Cloudflare (realtime edge, Durable Objects, R2 storage). Data: channel messages, creative assets, backups. Region: EU-eligible.
Vercel (application hosting). Data: app data and logs. Region: EU edge where available.
Redis Cloud and Upstash (dispatch queue, rate limits, idempotency). Data: job ids and counters, no source-of-truth data. Region: EU (Frankfurt).
AWS KMS (key management). Data: encrypted data-encryption keys. Region: EU.
02AI model inference
Anthropic (primary LLM). Data: agent prompts and outputs. Region: US.
OpenAI (fallback LLM). Data: agent prompts and outputs. Region: US.
DeepSeek (low-cost draft tier, active in production). Data: agent prompts and outputs. Region: outside the EU. Where data leaves the EEA we rely on Standard Contractual Clauses.
Creative generation runs through fal (image and video models). Data: your prompts and reference images.
03Communications, payments, and observability
Stripe (billing). Data: payment metadata. Region: US/EU. Card data is handled by Stripe; Atlas never stores card numbers.
Resend (transactional email). Data: email content and recipients. Region: US.
LiveKit (Team huddles). Data: meeting audio and video. Region: self-hosted / EU.
Self-hosted on our own EU infrastructure (no third-party processor): error tracking (GlitchTip), LLM tracing (Langfuse), and metrics.
04Transfers
Where a sub-processor processes data outside the EEA, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, with supplementary measures as needed. The current DPAs for each vendor are linked from our DPA on request.