Version 28 September 2026
Subprocessors, complete.
Who runs which part of Union AI, where that happens and under which jurisdiction the parent entity falls. Including the parts that are not European, because a list that leaves those out is not transparency but advertising.
The complete subprocessor list
| Party | Role | Processing region | Entity |
|---|---|---|---|
| Scaleway SAS | AI inference: all prompts and responses | European Union (fr-par) | France |
| Cloudflare, Inc. | Hosting, CDN and TLS termination | European Union (Cloudflare EU region) | United States |
| Neon (Databricks) | Database: accounts, credit, usage | EU region (on AWS) | United States |
| Stripe | Payments and VAT determination | EU processing via Stripe Payments Europe Ltd, Ireland | United States (parent entity) |
| Scaleway SAS | Transactional email | France | France |
| Linkup Technologies SAS | Web search, only when you turn on Search: the search query, nothing else | Not fixed: Linkup may route a query to the US, the EU, Canada or Asia-Pacific | France |
| Google Ireland Ltd | Website statistics (Google Analytics) and ad measurement (Google Ads): cookieless until you click Accept, cookies and a hashed email address after that. Never the chat or API | Not fixed: Google may process in the US, under the EU-US Data Privacy Framework | United States (parent entity) |
| Meta Platforms Ireland Ltd | Ad measurement (Meta Pixel and Conversions API), only after you click Accept: the ad click and a hashed email address. Never the chat or API | Not fixed: Meta may process in the US, under the EU-US Data Privacy Framework | United States (parent entity) |
If this list changes, we notify business customers with a data processing agreement in advance, so you can object before the change takes effect.
Google Drive and OneDrive (including SharePoint) are not on this list, because they are not ours: they are your own accounts. If you connect one, we keep the account's email address and an encrypted sign-in token, and fetch a file only when you pick it in the chat. The file is then handled like an upload: read on our servers and answered by the model inside the European Union. Disconnect and the token is deleted.
What we therefore do and do not claim
Every layer of Union AI runs in a European region. Three of the parties behind those layers have a US parent entity, and region is not the same as jurisdiction, so we keep our promises to what we control: where your prompts are processed and where the model runs. Linkup, for web search, is a French company, but by default it does not promise to process a query inside the EU.
- True: All AI inference runs on infrastructure inside the European Union.
- True: Your prompts and outputs never go to the United States or China.
- True: With web search on, one thing goes out: a short search query that our own model writes from your message, told to leave out names and other personal details. Your conversation, your files and your account never go to the search provider.
- True: The models run under our management and are not trained on customer data.
- Not true: “Web search stays in the EU.” Not guaranteed. Linkup's documentation says queries may be routed across the US, the EU, Canada and Asia-Pacific unless an enterprise agreement says otherwise, and that zero data retention is for enterprise customers. A query reflects what you asked, so leave Search off for a message you would not want turned into one.
What each layer sees of your prompt
Not every subprocessor sees the same thing. Concretely:
| Layer | Sees | Does not see |
|---|---|---|
| Scaleway (inference) | The prompt and the generated response | Your identity, your payment details, your usage history |
| Cloudflare | Encrypted traffic; TLS is terminated at the edge in Cloudflare's EU region, so the request content passes through the memory of that edge | Anything that is stored: there is no caching of API traffic |
| Neon | Account, balance, token counts and timestamps per request | The content of your prompts and responses |
| Stripe | Name, email, VAT number, payment details and amounts | Everything you do with the model |
| Linkup (only with Search on) | One short search query per message, written by our model from your message | Your conversation, your files, your account and your IP address |
Cloudflare runs in its EU region
Why not every party is European
It is technically possible to run the whole stack on European companies only. It is not possible to do that today, run it reliably and charge the prices on our pricing page. We have chosen to keep the part that matters most in substance, namely where your prompt is processed and where the model runs, fully European, and to be open about the rest instead of building a sovereignty story around it.
We are a young company and this stack is work in progress. If a European alternative can take over one of these roles reliably, we will move, and we will report that here.
What each layer can and cannot read is walked through hop by hop in where your prompts go: EU AI data residency. The retention periods behind these parties are in the privacy notice, and business customers get the same list contractually through the data processing agreement.
Frequently asked questions
What is a subprocessor?
A subprocessor is a third party that processes personal data on behalf of a processor. If you use an AI service to handle other people's data, its subprocessors are processing that data one step further down the chain, which is why the complete list has to be public and why you should get notice before it changes.
Does your data leave the EU when you use an AI API?
That depends on which data and which provider. With Union AI the prompt and the response are processed on infrastructure inside the European Union and never go to the United States or China, while hosting, database and payments involve companies with a United States parent entity. If you turn on web search, a short search query goes to Linkup, which may process it outside the EU. Ask any provider to answer these questions separately, because most answer only the first.
Does web search send my prompt to a search engine?
No. When you turn on Search, our own model inside the EU writes one short search query from your message, and only that query goes to Linkup, a French search API. Linkup may route queries outside the EU unless an enterprise agreement says otherwise, so the query can leave the EU even though your conversation does not. With Search off, nothing goes to Linkup at all.
Can a European cloud fall under the US CLOUD Act?
Yes, if the operator is a US company or a subsidiary of one. The CLOUD Act reaches data in a provider's possession, custody or control regardless of where it is stored, so a datacentre in Frankfurt does not by itself put data beyond it. Three parties in our chain have a US parent, and none of them is where your prompts are processed: that happens at Scaleway, a French company, inside the European Union.
Who can read my prompts?
With Union AI, only the inference layer sees the content of a prompt and its response, and it sees no identity, no payment details and no history. The database sees your account, balance and token counts, and the payment provider sees billing data only. With web search on, the search provider sees a short query written from your message, never the conversation itself.
What should be on an AI provider's subprocessor list?
Four columns: the party, what it does, the region it processes in, and the legal entity behind it. A list with regions but no entities hides the jurisdiction question, which is the one that matters for foreign access requests. It should also say how much notice you get before the list changes.
Will I be told when a subprocessor changes?
Yes. Business customers with a data processing agreement get at least 30 days' notice before a change takes effect, so there is time to object. If you object and we cannot resolve it, you can end the agreement and get unused credit back.