Each provider works on our instructions, only as far as it needs to, under a data processing agreement. Where data reaches a provider outside the EU, we rely on safeguards the GDPR recognises, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
| Provider | What it does | Where | Data it handles |
|---|---|---|---|
| Amazon Web Services | The sealed sandboxes where analyses run, and the files they work on | Frankfurt, Germany | Project files, analysis code and results |
| Railway | The Zatoona Labs application and its database, and this website with its cookieless analytics | Amsterdam, the Netherlands | Accounts, projects, conversations and the audit log; website requests and what you enter in its forms |
| OpenRouter | Routing the AI model calls of Zatoona Labs to the model providers, with zero data retention | United States | What each step sends to a model |
| AI model providers | Answering the steps of an analysis, reached through OpenRouter, with zero data retention | EU | What each step sends to a model |
| Parallel | The web searches Zatoona Labs makes during an analysis | United States | Search queries, never your files |
| Resend | Sending the emails from our forms and your account | United States | Names, email addresses and the content of those emails |
Changes
When this list changes, we update the date at the top. Institutions with a data processing agreement hear from us before a new provider starts.
How we handle personal data overall is in our Privacy Policy. Questions? Email contact@zatoona.ai.