Legal
Subprocessors
Last updated: 19 July 2026
Viti's promise is EU infrastructure with best-in-class models. Every model provider below is reached through a contractually EU-processing route, and personal identifiers are masked into reversible placeholders inside Viti's own infrastructure before prompt content reaches them.
Several vendors below are US-owned. That is disclosed deliberately: ownership and processing location are different things. Ownership is why the masking layer exists; the contractual routes below are what confine processing to the EU.
Model inference providers
These receive prompt and completion content — after masking — plus token counts. None of these routes retain content for provider-side training.
| Subprocessor | What it processes | Processing region |
|---|---|---|
| Microsoft — Azure OpenAI Service | Prompts, completions and token counts for GPT models | EU Data Zone (EUR) — processing and data at rest stay within EU/EFTA regions |
| Amazon Web Services — Bedrock | Prompts, completions and token counts for Claude and GLM models | EU regions only — Frankfurt / Ireland |
| Mistral AI — EU-native (France) | Prompts, completions and token counts for Mistral models; no training on API data | France |
| Scaleway — EU-native (France) | Prompts, completions and token counts for GLM and Mistral models. May keep request data for up to two weeks for troubleshooting. | France (Paris) |
| Google Cloud — Vertex AI (contingency route, not currently in use) | Claude models — a same-model fallback for Bedrock EU; enabling it requires prior notice under our change process | EU regions only |
Infrastructure and platform
| Subprocessor | What it processes | Processing region |
|---|---|---|
| Microsoft Azure | All application data: accounts, tenants, conversations, usage records, uploaded files, generated documents, logs. Platform email (invitations, billing notices, contact-form messages) through Azure Communication Services, data stored in Europe. | Sweden Central |
| Visma e-conomic A/S | Invoicing: billing contact, company name, VAT number, address and invoice amounts — never prompt or conversation content | Denmark, EU |
| Linkup | Web search, only when switched on: the search words the model composes, with personal identifiers such as ID numbers, email addresses and phone numbers removed first. Nothing is stored after the search. Never conversations or documents, and never on the sovereign tier. | France (EU), zero data retention |
| GitHub (Actions) | Source code and build artifacts — no customer data | US |
First-party endpoints we never use
Viti does not send customer data to api.openai.com, api.anthropic.com, api.moonshot.cn or api.deepseek.com. GPT models are reached exclusively via Azure OpenAI's EU Data Zone, and Claude exclusively via AWS Bedrock EU. This is enforced in code: a catalogue entry pointing at a non-EU-processing endpoint fails validation.
Changes to this list
We give 30 days' notice before adding or replacing a subprocessor that processes customer content, by email to your administrative contact and by updating this page. Data protection enquiries: hello@viti.fo.