EPAV DESK · SUB-PROCESSOR LIST
Version 1.0 · Effective from 9 October 2026
Operator: NeriusCognitaren OÜ, registry code 17503018, Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia
Questions and objections: privacy@epavdesk.com
This list is Annex 3 of the EPAV Desk Data Processing Agreement (the "DPA"). It names the companies that process personal data of your Visitors and Agents on our behalf when you use EPAV Desk ("Sub-processors"), what each does, which data it receives, where, and on what basis data leaves the European Economic Area (EEA).
How we tell you about changes. Before we add or replace a Sub-processor, we email the owner of every cabinet at least 30 days before it starts processing your data. You can object within 14 days of that email at privacy@epavdesk.com. Section 7 of the DPA describes what happens then, and when an urgent replacement is allowed. Each change is also recorded at the end of this page.
1. Always used
Railway Corporation
| What it does | Hosting: runs your Site (application, database, cache, knowledge server, files), our cabinet, our AI gateway and the chat widget |
|---|---|
| Data | All Customer Personal Data stored in your Site |
| Where | Your Site runs in Railway's EU West region (Amsterdam, the Netherlands). Railway is a US company, and its data processing agreement states that its primary processing operations take place in the United States |
| Company | Railway Corporation, United States |
| Transfer basis | EU-U.S. Data Privacy Framework (Railway is certified) and the Standard Contractual Clauses in Railway's data processing agreement |
| Its terms | https://railway.com/legal/dpa |
2. Used when the cloud AI of your plan answers
On a paid plan, the AI assistant uses our cloud AI while the AI budget of your plan lasts. Requests go from our AI gateway to OpenRouter, which passes each one to a model host. If you connect your own AI provider in your Site, the requests that it answers go to your provider instead, under your own contract with it.
OpenRouter, Inc.
| What it does | Routes requests from our AI gateway to the AI models listed below |
|---|---|
| Data | Conversation text and the pieces of your knowledge base used for an answer; Visitors' questions for search; the text of articles when they are added or changed; audio of voice messages; images sent in conversations; Agents' requests to the AI helpers in the panel |
| Where | United States (OpenRouter's own systems), then the model hosts in the table below |
| Company | OpenRouter, Inc., United States |
| Transfer basis | Standard Contractual Clauses in OpenRouter's data processing agreement. OpenRouter passes requests to the model hosts below under its own terms with them |
| Its terms | https://openrouter.ai/data-processing-agreement |
Models and hosts behind OpenRouter
| Function | Model | Hosts used | Where | Our settings |
|---|---|---|---|---|
| Answers to Visitors; AI helpers for Agents; drafts of knowledge base articles from resolved conversations; spelling check of answers in Estonian, Latvian and Lithuanian | openai/gpt-oss-120b | Chosen per request by OpenRouter among hosts meeting our settings. Seen in use on 7 October 2026: DeepInfra, DekaLLM | United States (DeepInfra), Indonesia (DekaLLM), as seen in use | Zero data retention; requests not used for training |
| Knowledge base search (turning text into search data) | baai/bge-m3 | Chosen per request by OpenRouter among zero-retention hosts; our backup routes are fixed to Parasail and DeepInfra | United States (Parasail, DeepInfra) | Zero data retention; requests not used for training |
| Voice message transcription | openai/whisper-large-v3-turbo | DeepInfra, Groq | United States | No settings can be sent with audio requests. The hosts that OpenRouter uses for this model keep no data |
| Description of images sent in conversations | qwen/qwen3.7-flash | Alibaba Cloud | Singapore and China (data centres listed by OpenRouter for this host) | Requests not used for training. Not zero retention: Alibaba states that it keeps requests and responses for no longer than 30 days |
| Ordering found pieces by relevance, only when our direct Voyage AI account (below) does not answer | voyageai/rerank-2.5-lite | Voyage AI | United States | Requests not used for training. Not zero retention |
Hosts named "seen in use" are chosen by OpenRouter for each request among those that meet our settings, and may change without prior notice from OpenRouter (Section 7.3 of the DPA). Hosts in Indonesia, Singapore and China are in countries without an adequacy decision; OpenRouter passes requests to them under its own terms with them.
Voyage AI Innovations, Inc. (MongoDB, Inc.)
| What it does | Orders the pieces of your knowledge base that search found by how well they answer the Visitor's question |
|---|---|
| Data | The Visitor's question and the pieces of articles found for it |
| Where | United States |
| Company | Voyage AI Innovations, Inc., a MongoDB company, United States |
| Transfer basis | EU-U.S. Data Privacy Framework (MongoDB, Inc. is certified, covering Voyage AI) and the Standard Contractual Clauses in Voyage AI's data processing agreement |
| Our settings | We use our own Voyage AI account, which is opted out of data use: under Voyage AI's terms, data sent after the opt out is deleted right after it is processed |
| Its terms | https://www.voyageai.com/dpa |
3. Used for email
SMTP2GO (Sand Dune Mail Ltd)
| What it does | Delivers email that EPAV sends for your Site: notifications to your Agents through the EPAV mailbox, and verification codes that your Site sends to Visitors through it |
|---|---|
| Data | Email addresses and names of recipients; the content of the notification, which includes the Visitor's name and message |
| Where | SMTP2GO's servers in the EU |
| Company | Sand Dune Mail Ltd, New Zealand |
| Transfer basis | Adequacy decision of the European Commission for New Zealand |
| When | Only when your Site uses the EPAV mailbox. If you connect your own mail server, your Site sends through it instead |
4. Used for our support
Google LLC (Gmail)
| What it does | Holds the mailbox behind our support address support@epavdesk.com |
|---|---|
| Data | What you send us in support requests, which may include Customer Personal Data, and exports of your data that we send you on request |
| Where | United States |
| Company | Google LLC, United States |
| Transfer basis | EU-U.S. Data Privacy Framework (Google LLC is certified) |
| When | Only when Customer Personal Data is in an email to or from our support |
5. Not Sub-processors
EPAV's own AI model. During a trial, when the cloud AI budget of your plan is used up, after 14 days of a failed payment, after the paid period of a cancelled plan, and as a backup when our cloud AI does not answer, the AI assistant answers, searches and transcribes on EPAV's own model, on hardware that EPAV operates itself in the EU. This is processing by EPAV, not by a Sub-processor.
Cloudflare, Inc. runs the DNS of epavdesk.com and receives no personal data of your Visitors. If we start receiving email for Sites through Cloudflare, we will add it to this list with the notice in Section 7.3 of the DPA.
Services you connect yourself. When you connect one of these, it works for you under its own terms, and EPAV passes data to it only on your instruction: your own AI provider, your own mail server or mailbox (including sign-in through Google or Microsoft), Telegram, Meta (WhatsApp), Atlassian Confluence, Shopify, WooCommerce, Cal.com, your webhooks and the custom tools of your assistant. The browser push services that deliver notifications to your Agents (from Google, Mozilla or Apple, depending on the browser) receive them encrypted.
Our own customer relationship. creem (Armitage Labs OÜ, Estonia) sells your subscription to you as merchant of record, and we use other services for our own support and accounts. These process data about you as our customer, not data of your Visitors, and are described in our Privacy Policy.
Change log
| Date | Change |
|---|---|
| 9 October 2026 | First version of this list |