Subprocessors

1. How we use subprocessors

We engage the following categories of subprocessors to provide model inference, self-service accounts, billing and support. Inference may run on infrastructure we deploy and operate, including leased GPU capacity, or through an independent provider's official API. With an external API, that provider receives the inputs and context needed for the request, performs inference and generates the output; this is distinct from infrastructure we operate ourselves.

We use only inference providers' official APIs, verifying provider identity and the API and model configuration before use. We do not use unverified relay or resale endpoints, misrepresent model identity or pass off a different model as the requested model.

Subprocessors act only on our instructions for the agreed purpose under contractual confidentiality and data-protection duties and privacy and security review. We require inference subprocessors to observe the Privacy Policy's no-training restriction and applicable retention rules. Session retention, caching, monitoring, debugging and other special processing, including provider retention, are separately disclosed or agreed for the relevant service. ZDR and data-residency requirements need an additional written agreement covering the relevant processing and providers. Interaction Data is not sent to account, sign-in or payment providers for model inference or training.

2. Current categories

• Third-party model inference providers (official APIs): receive only the prompts, model inputs, conversation context, parameters and other content necessary to fulfill the requested inference; process that data to generate outputs returned through our API, together with necessary usage and service-status metadata. Applicable processing and retention rules are described in the Privacy Policy and service-specific disclosures or agreements.
• Console hosting and account services: hosts platform.iteracompute.com sign-up, sign-in, account management and API-key issuance; processes account data and auth events.
• Third-party sign-in (OAuth, where offered): GitHub / Google or similar providers share basic profile data (account ID, email, name, avatar) at your direction for authentication only.
• Payment processing and invoicing: processes transactions and invoices; receives billing contact, amounts and limited card metadata (brand, last four digits, expiry). Full card numbers are handled by the payment provider only.
• Support ticketing and communications: processes support requests and contact correspondence you send to us.
• Service monitoring and logging infrastructure: processes API metadata, error logs and service-status data for billing, security, abuse prevention and operations.

3. Updates

We will update this page when we add or replace subprocessor categories for self-service offerings. Enterprise customers with signed agreements will be notified of material changes through the channels agreed in their service agreement. Specific vendor names and processing details are available on request or in enterprise security review, subject to confidentiality where permitted by law. Where applicable law requires additional recipient information, notice or separate consent, we provide that information and complete the required steps before the relevant processing.