Sub-processors
Last updated 21 September 2026. Changes are announced 30 days in advance to the customer contact on file.
The Operayde appliance processes customer prompts, documents, and retrieval content locally, on your premises. The central plane stores, for every gateway request, a metering row and SHA-256 hashes of the prompt, response and message array — never the prompt or response content itself. See our privacy policy for what that record contains, who can access it, and the customer-side verify flow. The infrastructure providers below host the central plane for their region; they provide compute/storage/network services and do not access that data as part of any service they provide us, but — unlike the other entries here (DNS, TLS, billing) — the underlying data for their region does live on their infrastructure. Regional- infrastructure rows below are labeled accordingly.
| Provider | Role | Location | Data categories |
|---|---|---|---|
| Hetzner Online GmbH | Central-plane infrastructure (region eu-south-1-fra) | Germany (EU) | Appliance metadata, audit heads, staff identities, virtual-key metadata, and per-request hash + metering rows (SHA-256 hashes, token counts, model, outcome — never prompt or response content) for EU-region customers. Infrastructure-only access — Hetzner does not process this data on our behalf beyond hosting the underlying storage. |
| AWS (Amazon Web Services EMEA SARL) | Central-plane infrastructure (region me-central-1, UAE region only) | UAE | Appliance metadata, audit heads, staff identities, virtual-key metadata, and per-request hash + metering rows (never prompt or response content) for UAE-region customers only. Infrastructure-only access — AWS does not process this data on our behalf beyond hosting the underlying storage. |
| Operayde LLC | Operayde's own regional entity operating central-plane infrastructure for the KSA region (not a third-party sub-processor — listed here for transparency about where KSA-region data is hosted) | Riyadh, Saudi Arabia | Appliance metadata, audit heads, staff identities, virtual-key metadata, and per-request hash + metering rows (never prompt or response content) for KSA-region customers only. |
| Let's Encrypt (ISRG) | TLS certificate issuance for central-plane and portal endpoints | USA | Public-facing DNS names only. No customer data. |
| Cloudflare, Inc. | DNS resolution for operayde.com and regional subdomains | USA (authoritative servers distributed) | Public DNS queries only. No customer data transits Cloudflare. |
| Stripe Payments Europe Ltd. | Billing processor (invoiced customers only; no direct card capture on our site) | Ireland (EU) | Billing contact, invoice line items, payment method token. No product data. |
Objecting to a change
Email legal@operayde.com within 30 days of the change announcement. Our DPA gives you the right to terminate the affected region if we cannot resolve the objection.