Subprocessors

Bohdan Matviichuk ("PlanVault", "PlanVault.ai", "we", "us", or "our") engages certain third-party vendors listed below as Subprocessors to help us operate, provide, improve, integrate, customize, and support our Services when we process Company Personal Data (as defined in the applicable Data Processing Agreement ("DPA")) on behalf of our Customers.

For the public hosted PlanVault.ai service, the primary application infrastructure is located in Germany (AWS region eu-central-1, Frankfurt). Two subprocessors, however, process limited data outside the EEA, primarily in the United States: Cloudflare, Inc. (global edge network for DNS, TLS termination, and a Cloudflare Tunnel to the Frankfurt origin) and Google LLC (transactional email via Google Workspace / Gmail SMTP and Login with Google via OAuth). Onward transfers to those subprocessors are covered by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with the supplementary technical and organizational measures described in our DPA. Full data isolation exclusively within the EU / EEA is NOT offered on the standard hosted tier — see Section 6 of the Privacy Policy (https://planvault.ai/privacy).

This page lists our typical categories of subprocessors and infrastructure providers that may be involved when operating PlanVault. The exact list depends on your deployment model (hosted SaaS, private cloud, or self-hosted).

Semantic Routing Cache: vector embeddings used for that product feature are stored only in your tenant database under your organization data-encryption key; they are not transferred to Customer-Controlled AI Providers as part of PlanVault’s routing traffic to those providers (which uses your BYOK credentials as described above).

The table below identifies our Subprocessors, details the nature and purpose of their services, and the location of processing. The Subprocessors we engage may change from time to time, and we may add or remove Subprocessors in the future. We will post updates to our Subprocessors on this page and provide notice, if applicable, in accordance with the terms of the DPA.

Terms used on this page but not otherwise defined shall have the meanings set forth in the DPA or in the applicable services agreement between us and the Customer.