A sub-processor is a third party that processes personal data on Ofivia’s behalf and on its instructions, so that some part of the service works. The law requires us to say who they are. This page is that list, and it is Annex III to the data processing agreement.
The company that contracts these providers and answers for them is [legal entity name], a Delaware corporation, which operates the service under the Ofivia name. The servers, the vault and the team that runs them are in Ecuador.
It is written for whoever has to approve Ofivia inside your company. If something here stops you signing, write to us and we will talk it through beforehand rather than after.
1. How to read the table
Each row is one provider. The data column says what that particular provider sees, not what the platform stores overall: each one receives only what its function requires. The country is where the provider is incorporated and, where we know it, the region it processes in. The last column goes to their own policy, not to a summary of ours.
2. Sub-processors in use
| Provider | What for | What data it touches | Country or region | Their policy |
|---|---|---|---|---|
| [infrastructure provider] | Running the platform: servers, disk and containers | Everything at rest: the database, the vault and the backups | [data centre country] | [infrastructure provider policy] |
| Anthropic | Serving the agent’s turns on Claude Code | The turn’s instruction, the conversation history and the contents of the files the agent reads or writes | United States | Privacy policy |
| OpenAI | Serving the agent’s turns on Codex, the alternative engine you pick per conversation | The same as the row above, when a conversation uses that engine | United States | Privacy policy |
| OpenAI, ChatGPT web interface | Generating images with the free tool | The prompt text and any reference images taken from the vault | United States | Privacy policy |
| NEXUSAI SERVICES LLC, which operates kie.ai | Generating images in bulk and generating video | The prompt text, and the reference image, video or audio their servers download over a signed link | United States | Privacy policy |
| Backblaze | Archiving off the server the media that is no longer used daily | The archived binary files: video, audio, images, PDFs and other attachments | United States, with the bucket in [archive bucket region] | Privacy policy |
| Amazon Web Services, SES | Sending the service’s own email and relaying outbound mail from your company’s mailboxes | Sender, recipients, subject and body of outgoing messages, plus the domain and its signing identifiers | United States, region [Amazon SES region] | Privacy policy |
| Cloudflare | Publishing the service behind their network and creating the DNS records for the mail domain | The traffic crossing the proxy, domain names and zone identifiers | United States, global network | Privacy policy |
| Browser push services: Google, Mozilla and Apple | Delivering the alerts you turned on to the subscribed device | The subscription endpoint, which identifies that device, and the timing of each delivery. The alert’s content is sealed and the provider does not read it | United States, global network | Google, Mozilla, Apple |
| Stripe | Charging the subscription by card and issuing the invoices | Billing name and email, tax identification where your country requires it, and the card details, which are typed on a Stripe page and never pass through our servers | United States | Privacy policy |
The square brackets are literal. They are details we do not publish yet because we do not have them firmly, and we would rather leave the gap than invent one.
3. Four rows that need explaining
The free image generator runs on a shared account. It does not use a programming interface with a business contract: it drives an automated browser over a single ChatGPT account that every company on the platform shares today. Prompts and reference images from different companies end up in the history of that same account, which we administer. It is the one place in the product where tenant isolation does not reach the provider. If your company would rather not use that tool, write to us and we will agree to switch it off for your account.
We do not upload your files to kie.ai: we publish them. When you ask for video generated from an image or an audio file of yours, that file is exposed at a signed link that expires in thirty minutes and serves only that one file, and kie.ai’s servers download it from there. During those thirty minutes anyone holding the address can download the file without logging in, and there is no way today to revoke the link before it expires.
Mail is read on our server and sent through Amazon. The mailbox, the messages you receive and the historical archive live on the mail server we run. What goes out does pass through Amazon SES, which acts as the relay and therefore sees the recipient and the body of the message.
The infrastructure provider sees everything at rest. We do not encrypt documents at the application layer. Whoever administers the server can reach the files. This is also stated in clause 5 of the data processing agreement and on the security page, and it is one of the reasons we offer self-hosting.
4. Card payment: the account exists, the charging does not yet
Stripe is the payment processor. The account is open and the integration is in the product, which is why Stripe sits in the table above and not on a waiting list.
What is not switched on yet is the charging. No card is charged today, in the product or on this site, and accounts are still opened by hand after a form. When charging is switched on, that row does not change: Stripe sees what it says there from the moment a billing account exists.
The descriptor on the card statement is the same legal entity that signs the terms of service, so the charge is recognizable when it arrives. Moving to another payment provider would be a change of sub-processor and takes the notice in section 7.
5. Our own machines outside the data centre
Video rendering and audio stem separation run on a machine with a graphics card that belongs to us but does not sit in the data centre. That machine downloads the project material, processes it and returns the result.
No third party is involved: the hardware is Ofivia’s and nobody else operates it. We list it here anyway, because the file physically leaves the main infrastructure and that is the kind of detail a vendor review needs to know.
6. Self-hosted services: no third party here
A good deal of what is an API call to someone else in other products runs on our own machines in Ofivia and listens only on the loopback interface. There is no provider to name in this list because there is no provider:
| Function | How it works |
|---|---|
| Indexing and search | An open embeddings model installed on our server |
| Audio transcription | A speech recognition model installed on our server |
| Voice and video calls | A conferencing server of our own |
| Database, cache and link graph | On our machines |
| Receiving and storing mail | A mail server of our own |
| Embedded consoles for support, automation and publishing | Installed on our infrastructure |
What that means in practice: indexing twenty years of documentation sends not one byte to a model provider, and transcribing a two-hour meeting does not either. That content never leaves the server and consumes no AI credit. The only moment your content travels to a third party is when an agent works on it, or when you ask for an image or a video to be generated.
7. Notice before adding a new one
Before adding or replacing a sub-processor we give thirty days’ notice, in two ways at once:
- By email to each client company’s administrative contact.
- By publishing the change on this page and moving the date in the header.
If a security or continuity emergency forces us to replace a provider without those thirty days, we give notice as soon as we can and explain why. The right to object in the next section survives unchanged.
8. How to object
Write to hola@ofivia.com within fifteen days of the notice, naming the provider and the reason. The reason has to be about data protection: the country, the purpose, the provider’s safeguards, a conflict with your own internal policy.
What happens next:
- We look for a reasonable alternative or a measure that resolves the concern, and we answer you.
- If we find none within thirty days, you may terminate the affected part of the service, or the whole contract, with no penalty, and we hand back your vault and your database under clause 9 of the data processing agreement.
And what this takes from you, said here and not in small print: if you do not reply within those fifteen days, the change counts as accepted and the provider goes into service.
9. What is not on this list
- Providers you hire. If you connect your own account with some service and give us a credential, that provider is yours and works for you. We store that credential encrypted and use it only for what you ask.
- Sites the agent visits. When the agent opens a web page or downloads a public video, that site receives the request, but it receives none of your content.
- Authorities. We hand over information when a competent authority requires it through legal channels. That is not processing on instruction and it is not authorized by contract.
10. If something here does not sit right
Write to hola@ofivia.com. If your company needs none of these providers involved at all, the way out is self-hosting: Ofivia installed on the server and in the country you choose, with the models you contract yourself.