Sub-processors | Zenzo AI

ZenzoLabs uses the third parties listed below to help deliver the Service. They are bound by written contracts containing data-protection obligations equivalent to those in our Data Processing Agreement. We will give at least 30 days' notice before adding or replacing a sub-processor that processes Customer Personal Data.

Infrastructure

Sub-processor	Role	Data processed	Location	Transfer mechanism
Contabo (VPS hosting)	Compute, storage, networking for the Service	All Customer Data at rest and in transit	United Kingdom	UK — no third-country transfer for UK customers. EU customers rely on the European Commission's UK adequacy decision (in force).
GitHub, Inc. (GHCR)	Container image registry; source-code repository	Application code & container images (no Customer Data)	USA	EU SCCs + UK IDTA; DPF certified

AI / Large Language Model providers

Used only when the Customer or end-user selects a model from the provider. ZenzoLabs' privacy firewall sends only the metadata and aggregated/derived results needed to answer the user's question — raw business data is not sent.

Sub-processor	Role	Data processed	Location	Transfer mechanism
OpenAI, L.L.C.	LLM completions / embeddings	Prompts, schema metadata, derived results	USA	EU SCCs + UK IDTA; DPF certified
Anthropic, PBC	LLM completions (Claude family)	Prompts, schema metadata, derived results	USA	EU SCCs + UK IDTA
xAI Corp. (Grok)	LLM completions	Prompts, schema metadata, derived results	USA	EU SCCs + UK IDTA
Google LLC (Gemini)	LLM completions / embeddings	Prompts, schema metadata, derived results	USA / EU	EU SCCs + UK IDTA; DPF certified

Operations

Sub-processor	Role	Data processed	Location	Transfer mechanism
Google LLC (Analytics 4)	Website usage analytics — only if the visitor accepts cookies	IP address (truncated), user-agent, page views	USA / EU	EU SCCs + UK IDTA; DPF certified
GoDaddy.com, LLC (Professional Email / Microsoft 365 via GoDaddy)	Transactional, contact-form, and business email for the zenzolabs.com domain	Name, email address, message content	USA / EU (Microsoft 365 data residency)	EU SCCs + UK IDTA; DPF certified (Microsoft); GoDaddy DPA

We do not currently use a payment processor. When paid plans launch we will add the chosen provider here at least 30 days in advance and notify subscribed customers.

Where exact provider selection is configurable per deployment (self-hosted, single-tenant), the active list for that deployment is documented in the customer's deployment runbook.

Questions about privacy?

Email privacy@zenzolabs.com. We reply within 2 business days.

All documents