European by default. The servers that hold your account, the GPUs that process your prompts and the party that takes your payment are all established in the European Union and process within it. Anything outside that path is named below, together with the exact circumstances in which it is engaged.
- Platform and database — Amsterdam, the Netherlands. Your account, keys, conversations and knowledge-base documents never leave this environment.
- Default inference — Dublin, Helsinki, Paris and other EU regions, on hardware from EU-established companies.
- Prompt retention by a sub-processor — none. Our per-token inference providers process prompts and completions ephemerally and do not store them.
- Sovereignty Mode — restricts processing to sub-processors with an EU establishment and EU-only processing locations. See section 4.
Under our Data Processing Agreement (GDPR Art. 28.2), the customer authorises HostYourAI to engage the sub-processors listed on this page. We notify customers in writing of any addition or replacement at least 30 days in advance; the customer has the right to object on reasonable grounds.
Last updated: 21 August 2026. This list reflects the platform configuration on that date. This page is the authoritative version; every change is recorded in the changelog at the bottom.
1. The European default path
These parties are established in the European Union and process customer data within it. Together they carry every request on a standard HostYourAI account.
Platform and storage
| Sub-processor | Establishment | Processing location | Purpose & data |
|---|---|---|---|
| UpCloud Ltd EU | Finland | Amsterdam, NL | Hosting of the application servers and the platform database: account details, API keys, conversation and usage records, knowledge-base documents and their embeddings. Stored on servers under our exclusive control; UpCloud supplies the infrastructure and is not a recipient of the data. |
| TransIP B.V. EU | Netherlands | Netherlands | DNS for hostyourai.com. No customer data beyond the domain records themselves. |
| Ploi.io EU | Netherlands | Netherlands | Server orchestration and deploy automation. Holds administrative access to servers under our control; no customer data is transferred to it. |
Inference
Which provider serves a given request depends on the model you select and, for a dedicated instance, on the provider you chose yourself. Prompt and response content passes through in transit. None of these parties is authorised to train on customer content.
| Sub-processor | Establishment | Processing location | Purpose & data |
|---|---|---|---|
| TensorX Limited EU | Ireland | Dublin, IE and Helsinki, FI | Per-token inference for shared Router models. Prompt and response content in transit. Contractual zero retention: prompts and completions are processed ephemerally and not stored. Their own EU inference estate is dedicated hardware; their corporate tooling includes non-EU providers that carry no customer inference content. |
| Scaleway SAS EU | France | France | Per-token inference for shared Router models via Generative APIs. Prompt and response content in transit. French-owned company and French data centres. |
| Mistral AI SAS EU | France | France, own data centres | Per-token inference for Mistral models. Prompt and response content in transit. Engaged only for requests to a Mistral model. |
| Nebius EU | Netherlands (group) | EU region eu-west2 |
Per-token inference for shared Router models. Prompt and response content in transit. We have verified Nebius's onward chain for our workloads: processing for HostYourAI traffic takes place in EU locations, and Nebius is included under Sovereignty Mode on that basis (see changelog, 2026-08-04). |
| UpCloud Ltd (GPU plans) EU | Finland | EU data centres | GPU capacity for dedicated instances and for large models. Prompt and response content in transit; model weights at rest on the GPU server. |
Payments and identity
| Sub-processor | Establishment | Processing location | Purpose & data |
|---|---|---|---|
| Stripe Payments Europe, Ltd. EU | Ireland | EU, with onward transfer to Stripe’s US entity under its own DPA | Payment processing, invoicing and VAT calculation: name, email, company, billing address, VAT number and tokenised payment method. Stripe acts as an independent controller for payment data. |
| Google Ireland Ltd. EU | Ireland | EU, with onward transfer under Google’s own terms | “Sign in with Google” authentication: email address, name and Google account identifier. Engaged only if you choose to log in with a Google account instead of a password. |
| Hugging Face, SAS EU | France | France / United States | Source of open-weights model files and private storage of our own fine-tuned models. No customer prompts, documents or account data flow to Hugging Face; the traffic is model weights only. |
2. Sub-processors established outside the EU
These five are named in full for transparency. None of them holds your account data. For the two GPU marketplaces the distinction matters and we want to be precise about it: the machines run in the European Union. What sits outside it is the company that operates the marketplace, not the hardware your prompts are processed on.
EU location is a hard filter, not a preference. When we select a machine, it is only eligible if its data centre is in one of the 27 EU member states or in Norway, Iceland or Liechtenstein, which fall under the same GDPR regime. The United Kingdom and Switzerland are deliberately excluded, because they rely on an adequacy decision rather than membership. A location we cannot establish with certainty counts as non-EU. The filter is never relaxed for price or availability: a customer who asked for EU hosting did not ask for a cheaper machine in Texas.
| Sub-processor | Establishment | Processing location | When engaged & safeguards |
|---|---|---|---|
| Vast.ai, Inc. non-EU | United States | EU data centres, enforced per machine | Engaged when we rent GPU capacity for a dedicated instance or for our own warm model pool. Prompt and response content in transit; model weights at rest on the rented GPU disk. The marketplace is US-incorporated; every machine we take from it is in the EU or the wider EEA. Excluded under Sovereignty Mode. |
| RunPod, Inc. non-EU | United States | EU regions | Fallback GPU capacity; not carrying traffic at the date above. Prompt and response content in transit; model weights at rest on the rented GPU disk. Same EU-location requirement as above. Excluded under Sovereignty Mode. |
| Proton AG non-EU | Switzerland | Switzerland | Hosting of our support mailbox and delivery of transactional email: the email address, name and message content of correspondence with info@hostyourai.com, and the content of account, billing and system emails. Switzerland holds an EU adequacy decision (GDPR Art. 45); Proton stores mail end-to-end encrypted at rest. |
| Mailgun Technologies, Inc. (Sinch) non-EU | United States, parent Sinch AB (Sweden) | EU sending region | Fallback delivery of transactional email; not carrying traffic at the date above. Email address, name and the content of system emails. Standard contractual clauses apply to the US operating entity. |
3. Customer-directed upstreams
You can point HostYourAI at a third-party model using your own API key. When you do, that provider processes your prompts under your agreement with them, not ours. We pass the request through and do not log the content.
| Provider | When engaged | Establishment | Data flow |
|---|---|---|---|
| OpenAI, L.L.C. non-EU | Only if you use an OpenAI BYOK instance or select an OpenAI model upstream | United States | Passthrough under your OpenAI agreement. |
| Anthropic, P.B.C. non-EU | Only if you configure a Claude BYOK upstream | United States | Passthrough under your Anthropic agreement. |
| Google LLC (Gemini API) non-EU | Only if you enable Gemini as the conversational backend on an agent | United States | Passthrough; we configure but do not retain content. |
4. Sovereignty Mode
Customers who require that no processing takes place outside the EEA can enable Sovereignty Mode on their account. In that mode we route exclusively to sub-processors with an EU establishment and EU-only processing locations.
Concretely, Sovereignty Mode excludes:
- Vast.ai and RunPod — US-incorporated GPU marketplaces, even where the racks are in the EU. Capacity from these marketplaces is never part of the sovereign chain.
- All customer-directed upstreams in section 3.
Inference then runs on TensorX, Nebius, Scaleway, Mistral and our own UpCloud GPU capacity. Sovereignty Mode is sold once the EU-only provider path, audit export and support-access controls are active on the account; write to info@hostyourai.com to arrange it.
5. Additional EU capacity in preparation
| Provider | Purpose | Jurisdiction | Status |
|---|---|---|---|
| OVHcloud | EU-sovereign GPU compute | France | Evaluation. |
| Hetzner Online GmbH | EU-sovereign GPU compute | Germany | Evaluation. |
How to be notified of changes
Material changes are emailed to the billing contact on each account and posted in the changelog below. To subscribe an additional address, write to info@hostyourai.com.
Changelog
- 2026-08-26 — TensorX Limited confirmed under Sovereignty Mode: EU establishment (Ireland), EU-only processing locations (Dublin, Helsinki) and contractual zero retention. The routing configuration now matches this page for every provider on it.
- 2026-08-21 — Calendly LLC disengaged. Appointment booking and video calls now run entirely on HostYourAI's own EU infrastructure (UpCloud, the Netherlands); no external booking or conferencing sub-processor is involved.
- 2026-08-10 — Proton AG (Switzerland, EU adequacy decision) engaged for the support mailbox and for transactional email delivery. TransIP now provides DNS only; Mailgun retained solely as a configured fallback for email delivery.
- 2026-08-04 — Verification of Nebius's onward sub-processor chain completed for HostYourAI workloads; Nebius included under Sovereignty Mode. Clarified that Vast.ai and RunPod capacity is never part of the sovereign chain.
- 2026-07-31 — Page restructured by jurisdiction, so that establishment and processing location are stated for every sub-processor. Platform infrastructure (UpCloud, TransIP) and supporting services now listed in full. Mistral AI listed under the European default path.
- 2026-07-30 — TensorX Limited engaged as a per-token inference provider.
- 2026-07-29 — Nebius Token Factory engaged as a per-token inference provider.
- 2026-07-21 — Scaleway Generative APIs engaged as a per-token inference provider.
- 2026-05-28 — Initial publication of this page.