Legal · Subprocessors
Subprocessors
The providers that process personal data on behalf of Interactive Media Solutions S.R.L. (IMS SRL) to operate codai, and the recipients that receive data as independent controllers.
Version 1.0 · Updated September 25, 2026
Summary in plain words
- Our infrastructure and the models we route to run in the EU.
- We announce any new subprocessor 30 days in advance, on this page and by e-mail to business account owners.
- The same list appears in the Privacy Policy and is referenced by the Data Processing Addendum (DPA).
01Subprocessors
| Recipient | What | Where | Safeguards |
|---|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) | Hosting, database and backups — all Service data | EU (Belgium, europe-west1) | Google Cloud Data Processing Addendum |
| Anthropic via Google Vertex AI | Model inference — prompts, outputs and tool results routed to Claude models | EU regions | Google Cloud DPA and Vertex AI terms — inputs are not used for training |
| Microsoft Azure AI Foundry | Model inference — prompts, outputs and tool results routed to models hosted there | EU regions | Microsoft Products and Services DPA |
| Cloudflare | CDN, edge network, DNS and DDoS protection for codai.ro (request metadata incl. IP address); cookieless, aggregate Web Analytics on the public website | Global edge network (nearest data centre; EU for EU visitors in normal operation) | Cloudflare DPA incl. Standard Contractual Clauses; EU-US Data Privacy Framework |
| Mail relay (Stalwart) | Transactional e-mail from mail.codai.ro — sign-in links, receipts, invitations, data exports (recipient address and message content) | EU | Self-hosted Stalwart mail server; no third-party e-mail service provider |
| Google Firebase Cloud Messaging | Push token and a wake-up signal (no message content) | Global (Google) | Google DPA; used only in builds configured with Firebase |
| Sentry | Error diagnostics from the web console; desktop crash reports only if you enabled them | EU / US | Sentry DPA incl. Standard Contractual Clauses |
02Independent controllers
These recipients receive data to provide their own service to you and decide themselves how they process it; we list them for transparency.
| Recipient | What | Where | Safeguards |
|---|---|---|---|
| Stripe | Payment and invoicing data | EU (Ireland) / US | Stripe DPA; Stripe is an independent controller for card data |
| Google / GitHub (sign-in) | Identity assertion when you choose to sign in with them | Global | Their own privacy policies apply |
03Changes
We publish any intended addition or replacement here at least 30 days before it takes effect. Business customers may object within that period under the DPA (codai.ro/dpa). Questions: [email protected].