Sub-processors
The providers who process personal data on Sajva's behalf, their role, where they process it, and the lawful basis for doing so. We never add a new sub-processor with access to a customer's material without 30 days' prior notice (data processing agreement §D.4) — you can object.
Last updated: 6 October 2026
In short
- Seven providers process data on our behalf today — no one else.
- Five of seven process exclusively within the EU/EEA.
- One processes outside it: Cloudflare, our CDN provider with a global network (Data Privacy Framework plus standard contractual clauses). Public web search moved to Staan, the European index run by Ecosia and Qwant, and is off by default.
1. Current sub-processors
| Provider | Role | Location | Transfer basis |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database and storage for the Sajva service | EU (Ireland, eu-west-1) | No transfer — processing occurs within the EU/EEA |
| Amazon Bedrock | AI models for suggested answers and knowledge-base search | EU, via Bedrock's EU region profile | No transfer — processing occurs within the EU/EEA |
| Microsoft (Teams) | Demo meetings — video calls and, with consent, recordings | EU/EEA | No transfer — processing occurs within the EU/EEA |
| Resend | Sending email — the sajva.ai contact form (book a demo), and transactional mail in the app (password resets, email verification) | EU (Ireland, eu-west-1) | No transfer — processing occurs within the EU/EEA |
| Staan (European Search Perspective) | Public web search for the optional public-sources feature in answers — would receive the company name and the question text. The European index built by Ecosia and Qwant, hosted in the EU with OVHcloud; queries are not used to train a language model. Where their own index cannot serve a query they document a fallback whose location they have not stated, so we do not claim EU-only processing for every query. Disclosed in advance under §D.4 and not yet in use: the feature is off by default and no customer has it switched on. | EU (OVHcloud) | No transfer for EU-served queries; the documented fallback is not established and the feature stays off until it is |
| Cloudflare | DNS and traffic routing (CDN) for sajva.ai | Global network | European Commission adequacy decision for the US (Data Privacy Framework) plus standard contractual clauses |
This website (sajva.ai) is itself currently hosted on infrastructure outside the EU/EEA during a transition period — see our privacy policy section 6. That's not a sub-processor in the GDPR sense (the website doesn't process personal data on anyone else's behalf), but we mention it here for completeness.
2. Changes to this list
Under our data processing agreement (§D.4), we give at least 30 days' notice before a new or changed sub-processor begins processing customer data. If you object on reasonable grounds as a customer, we'll work together to find a solution; if none is found, you may terminate the agreement.
Questions about a specific sub-processor?
Reach out at info@sajva.ai and we'll get back to you as soon as we can.