← Back to home

Sub-processors

Last updated: September 14, 2026

MeteorIT d.o.o. Beograd uses the service providers below to operate the Integral platform. This page is the complete list referred to in section 8 of our Privacy Policy and in section 5 of our Data Processing Agreement, and it is the list your organisation authorises when it accepts our Terms of Service.

Each entry states what the provider does for us, the entity and country where processing takes place, and the safeguard relied on when data leaves Serbia or the European Economic Area. Where an entry says "only when configured", no data reaches that provider unless your workspace administrators have switched it on.

1. Infrastructure

  • Vercel Inc. (United States) — application hosting and edge delivery. Transfers protected by Standard Contractual Clauses.
  • Supabase Inc. (United States; database hosted in the EU) — managed Postgres, authentication and file storage. This is where workspace content and account data live. Transfers protected by Standard Contractual Clauses.
  • Render Services Inc. (United States) — hosts the relay that on-premise agents dial out to. It carries request and response payloads for on-prem systems in transit; it does not store them. Transfers protected by Standard Contractual Clauses.
  • Upstash, Inc. (United States) — request rate limiting. It holds short-lived counters keyed by a workspace, user or token identifier, and no request content. Transfers protected by Standard Contractual Clauses.

2. AI model providers

Which of these processes your data depends on the models configured for your workspace. Under our agreements, none of them uses your data to train their models.

  • Anthropic PBC (United States) — Claude models.
  • OpenAI, L.L.C. (United States) — GPT models.
  • Google LLC (United States) — Gemini models.
  • Microsoft Corporation (United States/EU, by deployment region) — Azure OpenAI and Azure AI Foundry, which also serve models built by other vendors (for example xAI’s Grok). Data goes to Microsoft, not to the model’s original vendor.
  • Additional providers, only where an administrator has explicitly configured that provider for the workspace: Mistral AI SAS (France); Cohere Inc. (Canada; processing in the United States); Groq Inc. (United States); Together Computer Inc. (United States); Perplexity AI Inc. (United States). DeepSeek, Moonshot AI and Z.ai, all based in China, are not on this list: they are available only on your organisation’s own account, as section 8 explains.
  • OpenRouter, Inc. (United States) — a routing service that forwards a request to whichever model provider serves the chosen model, and is therefore an additional hop rather than a destination. Only when configured; the downstream provider is determined by the model your administrators select. It can be a provider based in China, or a free endpoint that may retain prompts, and no transfer safeguard of ours covers those downstream providers. Administrators are asked to confirm this when they configure it.

Transfers outside the EEA are protected by Standard Contractual Clauses. A workspace that must avoid a given provider can simply not configure it, and we will restrict a workspace to a named set of providers on request.

3. Document processing, embeddings and ranking

These providers sit inside the retrieval pipeline. They see document text and search queries rather than whole conversations, and the first of them sees the most: a document sent for parsing is sent in full.

  • LlamaIndex, Inc. — LlamaParse (United States) — converts PDFs and Office documents into text during indexing, including OCR for scanned pages. Files your workspace indexes are uploaded to it for that purpose. Transfers protected by Standard Contractual Clauses.
  • OpenAI, L.L.C. (United States) — the default embedding model. Text being indexed, and each search query, is sent to produce a vector.
  • Cohere Inc. (Canada; processing in the United States), Voyage AI (United States), Jina AI GmbH (Germany; processing in the United States and Singapore) and Together Computer Inc. (United States) — alternative embedding and reranking models. Only when configured for the workspace in place of the default.

Transfers outside the EEA are protected by Standard Contractual Clauses. Embedding and reranking providers receive text to score; they do not receive your account data.

4. Communications

  • Resend, Inc. (United States) — transactional e-mail only: invitations, password resets and scheduled report delivery. Transfers protected by Standard Contractual Clauses.

5. Web tools and maps

  • Tavily (United States) — web search, page reading and crawling, used only when a workspace has web tools enabled and only for the query at hand. Transfers protected by Standard Contractual Clauses.
  • OpenStreetMap Foundation (United Kingdom) — map tiles. When a map is shown, your browser requests the tiles directly from the tile server, which therefore sees your IP address and the area being viewed. No workspace content is sent. A workspace that prefers its own tile server can set one in settings.

6. Sign-in

Only if your organisation signs in with one of these. An account created with an e-mail address and password involves neither.

  • Google LLC (United States) — sign in with Google.
  • Microsoft Corporation (United States) — sign in with Microsoft.

These providers confirm who is signing in and return the name and e-mail address on the account. They receive no workspace content.

7. Analytics — only with your consent

These run on our public pages only (the landing, pricing and legal pages), never inside the signed-in application, and only after you opt in via the consent banner.

  • Google Ireland Ltd. (Ireland) — Google Analytics.
  • Microsoft Ireland Operations Ltd. (Ireland) — Microsoft Clarity. Microsoft acts as an independent controller of Clarity data, not as our processor.

8. Systems and AI accounts you bring are not on this list

When your workspace connects its own e-mail, file storage, ticketing, ERP or fleet system, that system is your provider, not ours. We reach it with the credentials your administrators supply and within the permissions they grant, and we do not replicate it. What the Platform keeps from it is described in section 2 of the Privacy Policy: what the assistant retrieved to answer a request, kept with that conversation, and the searchable copies of any folder your administrators enabled for indexing. Those systems themselves are governed by your agreements with them, not by this page.

The same holds for an AI model provider your organisation connects with its own account and API key. DeepSeek (China), Moonshot AI (China) and Z.ai / Zhipu AI (China) are available on that basis only: your organisation holds the contract with the provider, and the Platform sends it a request only when your administrators have configured it for the workspace. China is not recognised as providing an adequate level of data protection under the ZZPL or the GDPR, and the safeguards described on this page do not cover these providers. Whether to use them is your organisation’s decision, and so is the lawfulness of transferring any personal data a request contains. Administrators are asked to confirm this when they configure one of them.

9. Changes to this list

We notify customers before a new sub-processor starts processing personal data, with at least 30 days of notice, so there is time to object. To receive those notices, write to ai@meteorit.rs and ask to be added to the sub-processor notification list.

A customer who reasonably objects to a new sub-processor on data-protection grounds may raise it with us, and where we cannot offer an alternative the customer may terminate the affected part of the service.

10. Data processing agreement

Our Data Processing Agreement covers Art. 28 GDPR, including the Standard Contractual Clauses referred to above, and explains what these disclosures mean for a confidentiality agreement between us. Ask ai@meteorit.rs for the link, or for a signed counterpart.