SUB-PROCESSORS LIST JEDAI
Version 4.0 - May 2026
Translation notice. This is an English translation of the Dutch original, provided for convenience. In case of any discrepancy, the Dutch version (subverwerkers v4.0) prevails as the legally binding text.
This document is the current list of sub-processors that JedAi engages in the performance of Services. It forms part of the Data Processing Agreement (Annex 3) and of the Privacy Policy.
Last updated: 26 May 2026
Explanation
JedAi is a sole proprietorship that delivers a wide range of AI solutions. Depending on the specific Service and the Customer's choices, JedAi engages different external platforms. This list is category-based: per category we name the standard sub-processors and the nature of the processing. A specific selection may apply per engagement; on request the Customer receives an engagement-specific overview.
For material changes (e.g. adding a new category or replacing a fixed sub-processor) JedAi informs the Customer in accordance with article 7 of the Data Processing Agreement.
Category 1: Hosting and infrastructure
| Sub-processor | Service | Location | Transfer safeguards |
|---|---|---|---|
| Supabase Inc. | Database (PostgreSQL), authentication, storage | EU (Frankfurt) | SCCs + EU-region selected |
| Vercel Inc. | Hosting of web applications (CRM + marketing site jedai.nl) and edge functions | EU (Frankfurt), US | SCCs + EU-US DPF + EU-region for functions |
| Cloudflare Inc. | CDN, DDoS protection, DNS, Turnstile bot-protection | Worldwide | SCCs + EU-US DPF |
Category 2: AI model providers
JedAi may engage one or more AI providers depending on the engagement. The primary providers are:
| Sub-processor | Service | Location | Transfer safeguards |
|---|---|---|---|
| Anthropic PBC | AI model API (Claude) - primary provider for AI assistant and chatbot | US | SCCs + EU-US DPF + zero data retention where available + DLP filter applied beforehand |
| OpenAI L.L.C. | AI model API (GPT series) | US | SCCs + zero data retention where available |
| Google LLC | AI model API (Gemini), Google Cloud | EU, US | SCCs + EU-region where possible |
| Microsoft Corporation | Azure OpenAI, Microsoft 365 Copilot | EU (Azure regions) | EU Data Boundary + SCCs |
Depending on the engagement additional AI providers may be used (including Mistral, Cohere, Perplexity, open-source models hosted via providers such as Hugging Face or Replicate). When an engagement requires an additional provider, this is recorded in the quote or order confirmation.
Category 3: Communication
| Sub-processor | Service | Location | Transfer safeguards |
|---|---|---|---|
| Resend Inc. | Transactional email (quotes, invoices, notifications, mailings) | US, EU-region available | SCCs + EU-region selected |
| Microsoft 365 | Business email (info@jedai.nl mailbox synchronisation via Graph API), calendar, document management | EU (Azure regions) | EU Data Boundary + SCCs |
Category 4: Security and monitoring
| Sub-processor | Service | Location | Transfer safeguards |
|---|---|---|---|
| Upstash Inc. | Redis database for rate-limiting, session state, anti-abuse counters | EU (Frankfurt) | SCCs + EU-region selected |
| Functional Software Inc. (Sentry) | Error monitoring and performance tracking, with active PII scrubbing applied beforehand | EU (Frankfurt) | SCCs + EU-region selected; cookies, auth headers and email addresses are scrubbed client-side prior to transmission |
Category 5: Development and code
| Sub-processor | Service | Location | Transfer safeguards |
|---|---|---|---|
| GitHub Inc. | Code repository, version control, CI | US, EU storage where available | SCCs - contains no customer data (source code + configuration) |
Category 6: Customer-prescribed or project-specific tools
For specific engagements the Customer may prescribe a platform, model or service that does not appear in the categories above (see definition "Prescribed Third Parties" in the Terms and Conditions, article 1.1.j). Examples: a specific CRM (Salesforce, HubSpot), an analytics platform, a specific LLM gateway product, an industry solution.
The terms and processing arrangements for Prescribed Third Parties apply additionally; these are described in the relevant engagement and are also available from the supplier of the product.
Notes
AI training and customer data
JedAi does not use customer data, prompts, documents or content to train, retrain or fine-tune public or shared AI models (see Terms and Conditions, article 16.6). Only anonymised metadata (error reports, performance statistics, usage volumes) may be used for internal quality improvement.
Zero data retention
With AI providers that offer "zero data retention" or comparable opt-outs, JedAi makes use of these for production processing involving personal data, to the extent the service supports this.
DLP filter prior to AI calls
Prior to every API call to an external AI provider, a Data Loss Prevention filter runs that detects and redacts direct personal data (BSN, IBAN, phone numbers, email addresses, names where possible). This limits the actual transfer of personal data without breaking AI functionality.
Processing location
JedAi prefers EU data centres where this is technically and functionally possible. For AI models that run only in US regions, the relevant SCCs and additional measures (DLP, zero-retention) are applied.
External data sources (not sub-processors)
For company enrichment, JedAi consults the public Dutch Chamber of Commerce (KvK) Trade Register API. In this case the KvK is the source (data publisher) and not a sub-processor of JedAi customer data. No personal data of JedAi customers is shared with the KvK in this enrichment flow.
Objection to sub-processors
Pursuant to article 7.2 of the Data Processing Agreement, the Customer may object to the use of a (new) sub-processor. Objections in writing to privacy@jedai.nl within 14 days of notification of the change.
Contact
Questions about this sub-processor list:
- Privacy / GDPR: privacy@jedai.nl
- General: info@jedai.nl
- Post: JedAi, Boerderijweg 62, 3262 CC Oud-Beijerland, Netherlands
JedAi (sole proprietorship) CoC: 42049125 VAT: NL005455557B05