Legal

Subprocessors

This page summarizes provider categories used by AI Team, operated by Akii Technologies, Ltd. Enterprise records must map exact vendor, purpose, data category, region, transfer basis, support access, retention posture, and allowed data class before production use.

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Provider use must stay aligned with provider governance, model routing, analytics governance, and signed client terms.

Default hosting uses EU/international providers unless a separate in-country deployment is contracted and evidenced.
Material provider changes can require client notice depending on the applicable agreement.
Client-specific provider restrictions are captured during setup and access review.

Core infrastructure

Core providers keep the public site, dashboard, database, authentication, storage, and Agent work available.

Railway: application hosting and deployment runtime; currently not represented as a UAE-region provider in public region docs.
Supabase: Postgres, Auth, Storage, Row Level Security, and vector database capabilities; currently not represented as a UAE-region provider in public region docs.
Cloudflare or equivalent edge services: DNS, security, caching, bot protection, WAF, and traffic protection where configured.

Billing and communication

Billing and email providers support subscriptions, invoices, notices, account access, support, and marketing preferences.

Stripe: checkout, subscriptions, invoices, tax support, payment events, customer portal, and billing records.
Transactional email: account access, password reset, setup, billing, service notices, and operational notifications.
Marketing email: opt-in newsletters and educational content, separated from transactional service messages.

Monitoring and analytics

Monitoring providers help AI Team find incidents, review quality, and understand public-site conversion paths.

Sentry: application errors, performance data, release monitoring, and diagnostics with redaction requirements.
Langfuse: prompt, model, evaluation, and Agent run review where enabled, limited to safe summaries and approved traces.
Plausible or equivalent product analytics: page, funnel, and conversion measurement where consent rules allow.

Model providers

Model providers vary by Agent, data class, client restriction, availability, cost, quality, and approved model route.

LiteLLM routes model usage, budgets, fallbacks, aliases, and policy controls where configured.
Examples can include OpenRouter and Z.AI for the GLM-5.2 workhorse route, plus OpenAI, Anthropic, Google, Mistral, Groq, Together, Fireworks, or other approved providers.
Excluded regulated data is blocked from model routes; personal or sensitive data requires data-class approval before production use.

Agent-specific tools

Third-party APIs may vary by Agent, client-owned account, and approved pass-through usage.

Examples include CRM, helpdesk, ecommerce, accounting, workspace, SEO, ads, enrichment, email, SMS, voice, and analytics services.
Client-owned accounts remain governed by the client's own provider contracts, settings, permissions, and deletion controls.
Paid or high-variance providers need billing owner, spend cap, warning threshold, stop rule, and escalation owner before production use.

Approval records

Enterprise subprocessor approval records must be complete before a client Agent goes live.

Each record should include vendor/entity, purpose, data categories, location/region, transfer basis, support access, retention, and model-training stance.
Provider use must be compatible with the Agent data class and client restrictions.
AI Team may remove or replace providers that create unacceptable security, privacy, compliance, reliability, or cost risk.

Next step

Need help applying this policy?

Start with setup so AI Team can confirm the work, required access, approval rules, pass-through costs, and go-live requirements.

Start setup Contact AI Team