Sub-processors
The companies that process personal data on Atlantic Agentic Labs’ behalf when we provide LightHouse and our services. Your data processing agreement refers to this list.
Last updated 30 October 2026.
When this list applies to you
Section titled “When this list applies to you”“When” in each table says when a company receives your data through Atlantic.
- Direct: your own model providers, cloud and identity provider act under your contracts with them. They are not Atlantic’s sub-processors, and this list does not apply to them.
- Managed: where Atlantic provides the service (managed model access, Octy where Atlantic serves it, Atlantic-hosted), the provider is Atlantic’s sub-processor and is listed here.
Your content stays in your account either way; see Data sovereignty. A model provider receives a prompt only when your gateway calls it.
Hosting, edge and models
Section titled “Hosting, edge and models”| Company | What for | Data | Where | When |
|---|---|---|---|---|
| Amazon Web Services | Hosts LightHouse (service, database, storage). Amazon Bedrock model access (Claude, Amazon Nova, Llama, Mistral, Cohere, DeepSeek, Qwen and others) | Account and user details, operational telemetry, audit records. For Bedrock: prompts and responses, not stored or used for training | EU (Ireland, eu-west-1); Bedrock pinned to EU regions |
Always (hosting); managed model access |
| Google Cloud | Vertex AI model access (Gemini, Gemma, Claude, Llama and others); Google Cloud deployments | Prompts and responses; deployment metadata | EU regions, pinned | Managed model access through Google Cloud |
| Microsoft | Azure hosting for Azure deployments; Azure OpenAI and Azure AI Foundry models (including Phi) | Prompts and responses; deployment metadata | EU regions, pinned | Managed model access or hosting through Azure |
| Anthropic | Claude models through the Claude API | Prompts and responses; zero data retention requested | Per the inference geography disclosed to you | Managed model access, and Octy when served on Anthropic |
| OpenAI | OpenAI models through the OpenAI API | Prompts and responses; zero data retention requested | EU data residency where offered, otherwise United States with standard contractual clauses | Managed model access to OpenAI models |
| Mistral AI | Mistral models through Mistral’s own API | Prompts and responses | EU (France) | Managed model access through Mistral’s API. Mistral on Bedrock or Vertex AI falls under those rows |
| Cohere | Command models through Cohere’s own API | Prompts and responses | Per Cohere’s region, with standard contractual clauses where outside the EU | Managed model access through Cohere’s API |
| xAI | Grok models through the xAI API | Prompts and responses | United States, with standard contractual clauses | Managed model access to Grok |
| NVIDIA | NVIDIA NIM hosted endpoints (Nemotron and other models) | Prompts and responses | United States, with standard contractual clauses | Managed model access through NVIDIA’s hosted endpoints. Self-hosted NIM sends NVIDIA nothing |
| Cloudflare | Edge network, DNS and access control in front of LightHouse; the company site | Network metadata; sign-in identity at the edge | Global edge | Always |
Contracting entities include Amazon Web Services EMEA SARL (Luxembourg), Google Cloud EMEA Limited (Ireland) and Microsoft Ireland Operations Limited.
Services
Section titled “Services”| Company | What for | Data | Where | When |
|---|---|---|---|---|
| Stripe | Payments, invoices, VAT number validation | Billing contact, company and VAT details, payment method (held by Stripe) | EU (Ireland), with Stripe’s transfer safeguards | When Atlantic bills you |
| Resend | Sends the company site’s form emails (enquiries, NDA requests) | Name, email, company, message | United States, with standard contractual clauses | Site forms only |
Listed so you know a model’s origin, but not sub-processors
Section titled “Listed so you know a model’s origin, but not sub-processors”| Company | Why it is listed | Data it receives |
|---|---|---|
| Meta (Llama) | Open-weight models | None: run on AWS, Google Cloud, Azure or your own cloud |
| IBM (Granite) | Open-weight models | None, as above |
| Alibaba Cloud (Qwen) | Open-weight models | None: run only on the clouds above or your own. Atlantic does not send your data to Alibaba Cloud’s API |
| DeepSeek | Open-weight models | None: run only on the clouds above or your own. Atlantic does not send your data to DeepSeek’s API |
| LangChain (LangGraph) | Open-source orchestration library inside the engine | None: the library runs in your deployment or Atlantic’s. No LangSmith or hosted LangGraph |
Also not sub-processors: Atlantic’s source hosting and CI, which hold no client personal data.
Transfers
Section titled “Transfers”Each sub-processor’s own data processing terms cover Atlantic’s onward obligations under Article 28(4) GDPR. Processing outside the EU relies on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, as each row says. See Legal.
How changes are notified
Section titled “How changes are notified”Before a new sub-processor starts processing your data, Atlantic gives notice by email to your billing contact: 30 days by default. The notice period is one of your commercial terms, visible in LightHouse under Spend → Terms.
You may object within the notice period. If the objection cannot be resolved, you can stop using that provider or end the affected service.
This page’s “last updated” date changes with every addition, replacement or removal. See Change notices.