Legal · official document
Subprocessors
Updated October 13, 2026
These are the third parties that process data on our behalf so ValorBrain can run. It is the list your legal team will ask for alongside the DPA, so it lives here, in public, instead of in an annex nobody can find.
What stays on our own infrastructure
Your documents, the vectors built from them and the Postgres database sit on our own hardware in Santa Catarina, Brazil. Embedding, reranking and named-entity recognition (NER) run on that machine's GPU — none of those steps leaves it. The router that forwards calls to the language model (Manifest) also runs on our own infrastructure, so it is not a third party. Error monitoring is self-hosted too.
The international transfer that does happen
What leaves the country is processing by the language model, which is a cloud service. It receives text in three situations: for an answer (/ask), the question and the retrieved passages; for a search, the query text, which the model rewrites to find more results (query expansion); and in automatic background processing, passages of stored content, from which the model extracts entities and observations, consolidates memories and writes summaries. An external classifier also receives passages for yes-or-no judgments. If you cannot have that, run ValorBrain entirely in your own environment (on-prem) under an Enterprise contract.
The list
| Who | What for | What they receive | Where |
|---|---|---|---|
| Cloudflare, Inc. | Network edge: DNS, TLS termination and the tunnel that publishes the service. | All HTTPS traffic passes through it, request and response bodies included. Content is in transit, not stored. | United States and global network |
| Anthropic, PBC (Claude Haiku 5.5) | Language model that processes text: writes answers (/ask), rewrites search queries (expansion) and runs the automatic background processing of stored content (extraction of entities and observations, consolidation, summaries). | For answers: the question and the retrieved passages. For search: the query text. In the background: passages of stored content. Calls go through our router (Manifest), which runs on our own infrastructure. | United States |
| Z.AI (Jingsheng Hengxing Technology Pte. Ltd.; GLM-5.3-Flash model) | Fallback model for answers (/ask): called only when the primary model fails. | The same content the answer would send to the primary model: the question and the retrieved passages. | Singapore |
| TypeSafe AI, Inc. (api.typesafe.ai) | Classifier that returns yes-or-no judgments with a probability, without writing text. It classifies decisions during background consolidation and runs automatic checks during retrieval (whether the results are enough to answer, whether they contradict each other, whether a passage is worth extracting). | Short passages of stored content and, for the retrieval checks, the question and passages of the retrieved results. | United States |
| Stripe | Subscription billing, card and boleto. | Name, email, billing details and invoice history. No indexed content is sent, and we never store card numbers. | United States and Ireland |
| Google LLC | Google sign-in (optional) and reading the sources you connect. | At sign-in: name, email, avatar. On connectors: whatever the authorized Drive, Gmail or Calendar scope allows us to read. | United States |
| Hostinger International Ltd. | Host of the transactional mail server we operate (verification, notices, invoices). | Recipient address and the content of the message we send. | São Paulo, Brazil |
| Telegram FZ-LLC | Operational alert channel for our on-call team. | Technical identifiers and error messages (account, route, code). Not a channel for document content. | United Arab Emirates and global network |
Sources you connect
Google Drive, Gmail, Calendar, Notion, GitHub and Slack only enter the path once you authorize the connection, and they read only what the OAuth scope allows. Revoke any of them in Settings → Connectors. Until you connect one, it sees nothing.
What we do not do
- We do not train models on your workspace content.
- We do not sell or share your data.
- We use no advertising analytics and no tracking cookies.
Changes to this list
Before adding a subprocessor that touches customer content we give 30 days' notice by email to the account's admin contact. If the addition does not work for you, you may terminate without penalty within that window — it is in the data processing agreement.
Contact
Data Protection Officer: Gustavo Iucksh Santos · valorbrain@valor.digital