Service providers and sub-processors
Version 4 · last updated 31 August 2026 · the register referenced by Annex III of our Data Processing Agreement
These are the main third parties used by the core platform. The table states the role we currently assign to each service. Contract and role evidence must be approved before paid service opens. Customer-chosen integrations can use other providers and locations; those are disclosed before activation.
Currently engaged
| Sub-processor | Role | Purpose | Established in | What it receives |
|---|---|---|---|---|
| OVHcloud SP-1 | Processor and subprocessor for hosting and operational email. | Hosting, storage, compute, backups and operational email. The platform and its database run here. | France (infrastructure used: Frankfurt, Germany; backups replicated to Gravelines, France) | Everything the platform holds, since it is the infrastructure the platform runs on: account records, uploaded research data, generated artifacts, backups, email recipients and message content. |
| Mollie SP-4 | Payment provider; normally an independent controller for payment method data. Final role evidence is a paid-release gate. | Hosted payment processing and subscription billing when paid plans open. | Netherlands | Billing contact details and payment records for the paying workspace. No research content reaches Mollie. |
Your research data
Only the hosting provider holds research content as part of the core service. Datasets, pipelines, runs and reports are not sent to the payment or bot-challenge providers. A customer can instruct an export to its own connected repository or code host.
Changes to this register
Version 4, 31 August 2026. Transactional email is now sent first-party from our own OVHcloud mailbox over SMTP. No third-party email processor is used; email is covered by OVHcloud (SP-1), the same EU infrastructure the rest of the platform already runs on.
Version 3, 10 August 2026. Database backups are now replicated to a second OVHcloud region, Gravelines in France, so that a region-level or bucket-level failure cannot destroy the platform and its backups together. Both regions are in the EU and the sub-processor is unchanged. It is recorded here because this register states where data actually sits, not only who holds it.
Version 2, 2 August 2026. The register moved to this page and gained the detail an institutional review asks for: what each sub-processor receives, not only that they exist.
Version 1, 27 July 2026. Payments moved to Mollie (Netherlands) from a United States provider, and hosting moved to OVHcloud from a United States provider. No sub-processor outside the EEA remains.
Objecting to a change
If your institution objects to a new sub-processor on reasonable data-protection grounds, write to contact@alkhemyst-ai.cloud and we will work through it with you under the terms of the DPA. To be notified of changes rather than checking this page, ask us to add your DPO to the notification list at the same address.
Getting the DPA
Read the Data Processing Agreement under EU Legal Terms. An authorised workspace administrator can review and sign it in Settings on behalf of the institution. A signed copy is stored in the platform and emailed to the signer and AlkhemYst-Ai.