Sub-processors
The providers who process personal data on Sajva's behalf, their role, where they process it, and the lawful basis for doing so. We never add a new sub-processor with access to a customer's material without 30 days' prior notice (data processing agreement §D.4) — you can object.
Last updated: 25 August 2026
In short
- Seven providers process data on our behalf today — no one else.
- Five of seven process exclusively within the EU/EEA.
- Two process outside it: Cloudflare, our CDN provider with a global network (Data Privacy Framework plus standard contractual clauses), and Brave Search, used only where a customer has switched on public web sources in answers (standard contractual clauses).
1. Current sub-processors
| Provider | Role | Location | Transfer basis |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database and storage for the Sajva service | EU (Ireland, eu-west-1) | No transfer — processing occurs within the EU/EEA |
| Amazon Bedrock | AI models for suggested answers and knowledge-base search | EU, via Bedrock's EU region profile | No transfer — processing occurs within the EU/EEA |
| Amazon SES | Sending transactional email in the app (e.g. password resets) | EU | No transfer — processing occurs within the EU/EEA |
| Microsoft (Teams) | Running webinars — registration, attendance, recording | EU/EEA | No transfer — processing occurs within the EU/EEA |
| Resend | Sending email from the sajva.ai contact form (book a demo) | EU (Ireland, eu-west-1) | No transfer — processing occurs within the EU/EEA |
| Brave Search | Public web search for the optional public-sources feature in answers — would receive the company name and the question text. Disclosed in advance under §D.4 and not yet in use: the feature is off by default and no customer has it switched on. | United States | Standard contractual clauses (Brave Search API data processing addendum) |
| Cloudflare | DNS and traffic routing (CDN) for sajva.ai | Global network | European Commission adequacy decision for the US (Data Privacy Framework) plus standard contractual clauses |
This website (sajva.ai) is itself currently hosted on infrastructure outside the EU/EEA during a transition period — see our privacy policy section 6. That's not a sub-processor in the GDPR sense (the website doesn't process personal data on anyone else's behalf), but we mention it here for completeness.
2. Changes to this list
Under our data processing agreement (§D.4), we give at least 30 days' notice before a new or changed sub-processor begins processing customer data. If you object on reasonable grounds as a customer, we'll work together to find a solution; if none is found, you may terminate the agreement.
Questions about a specific sub-processor?
Reach out at info@sajva.ai and we'll get back to you as soon as we can.