Legal
Subprocessors
Last updated: 19 July 2026
Viti's promise is EU infrastructure with best-in-class models. Every model provider below is reached through a contractually EU-processing route, and prompt and completion content only reaches them after personal data has been masked into reversible placeholders inside Viti's own infrastructure.
Several vendors below are US-owned. That is disclosed deliberately: ownership and processing location are different things. Ownership is why the masking layer exists; the contractual routes below are what confine processing to the EU.
Model inference providers
These receive prompt and completion content — after masking — plus token counts. None of these routes retain content for provider-side training.
| Subprocessor | What it processes | Processing region |
|---|---|---|
| Microsoft — Azure OpenAI Service | Prompts, completions and token counts for GPT models | EU Data Zone (EUR) — processing and data at rest stay within EU/EFTA regions |
| Microsoft — Azure AI Foundry | Prompts, completions and token counts for Kimi, DeepSeek and open-weight models | Data Zone EUR — Microsoft-hosted; no data reaches China |
| Amazon Web Services — Bedrock | Prompts, completions and token counts for Claude models | EU regions only — Frankfurt / Ireland |
| Mistral AI — EU-native (France) | Prompts, completions and token counts for Mistral models; no training on API data | France |
| Google Cloud — Vertex AI (contingency route, not currently in use) | Claude models — a same-model fallback for Bedrock EU; enabling it requires prior notice under our change process | EU regions only |
Infrastructure and platform
| Subprocessor | What it processes | Processing region |
|---|---|---|
| Microsoft Azure | All application data: accounts, tenants, conversations, usage records, uploaded files, generated documents, logs | Sweden Central |
| QuickPay ApS | Payment card data and billing contact details: billing contact, company name, VAT id and invoice amounts — never prompt or conversation content | Denmark (company); processing location not stated |
| Clearhaus A/S | Card authorisation and settlement. Acts as an independent controller under its own regulatory duties, not on instructions from Viti | Denmark, EU |
| GitHub (Actions) | Source code and build artifacts — no customer data | US |
First-party endpoints we never use
Viti does not send customer data to api.openai.com, api.anthropic.com, api.moonshot.cn or api.deepseek.com. GPT models are reached exclusively via Azure OpenAI's EU Data Zone, Claude exclusively via AWS Bedrock EU, and Kimi and DeepSeek exclusively via Azure AI Foundry Data Zone EUR. This is enforced in code: a catalogue entry pointing at a non-EU-processing endpoint fails validation.
Changes to this list
We give 30 days' notice before adding or replacing a subprocessor that processes customer content, by email to your administrative contact and by updating this page. Data protection enquiries: hello@viti.fo.