## Overview This page lists the sub-processors Rivano AI engages to operate the hosted service. We provide **30 days' written notice** before adding a new sub-processor or replacing an existing one for paying customers. To receive these notices, email [email protected]. The list below applies to the SaaS-hosted control plane and dashboard. Hybrid and on-prem deployments inherit only the sub-processors that touch your data path; for hybrid that is typically only Cloudflare (TLS edge) and Stripe (billing). On-prem deployments engage no Rivano sub-processors at all. ## Sub-processors | Sub-processor | Service | Data location | Purpose | |---|---|---|---| | Cloudflare, Inc. | Pages, CDN, WAF, Web Analytics, R2 | Global edge | Static asset hosting, DDoS protection, cookieless traffic analytics | | Google Cloud, LLC | Cloud Run, Cloud SQL (Postgres), Cloud Logging, Secret Manager | `us-east1` | Hosting the control plane, data plane, and customer database | | Zitadel | OIDC identity | EU + US | OAuth/OIDC authentication | | Stripe, Inc. | Payments | US | Billing for paid tiers; Stripe is the sole holder of card data | | Resend | Transactional email | US | Account, billing, and security email delivery | ## Data residency Hosted infrastructure runs in `us-east1`. Customer data is stored in Cloud SQL with at-rest encryption (Google-managed keys; Customer-Managed Encryption Keys available on Enterprise tier). Backups are stored in the same region. ## Standard Contractual Clauses For customers transferring personal data from the European Economic Area, United Kingdom, or Switzerland, our [Data Processing Agreement](/legal/dpa) incorporates the EU Standard Contractual Clauses (Module 2: controller to processor). UK customers receive the IDTA Addendum. ## Changes To subscribe to sub-processor change notifications, email **[email protected]**.