The suppliers, category by category
LegalLast updated: August 2026
The complete register, with names, locations, sub-processors and retention for each supplier, is delivered before signing and updated at every change. Here is the structure: who does what, on which data, with which safeguards.
Service provided
Data processed
Location and safeguards
Language processing (chat)
Conversation text and store context in the prompt
Processing may take place outside the European Union, with the safeguards of Articles 44-49 GDPR, normally the standard contractual clauses; each supplier's actual location and safeguards are documented in the register delivered before signature
Answer verification and speech synthesis
Answer to be checked, store context, audio clips for transcription only
EU hosting by default; any temporary transfers to the supplier's own sub-processors are documented in the register
Realtime voice
Realtime audio stream, never archived by Kartio, and strictly necessary context
Region and retention proven in the activation sheet; activation only with the controller's documented authorisation
Application and database hosting
The service data at rest and in processing
Country and data centre documented in the register
Encrypted backups
Encrypted copy of the data; the custodian does not hold the key
Second host, country documented in the register
HTTPS transport and protection
Data in transit and network metadata
Distributed network; safeguards under the service's DPA
Transactional email
Email addresses used to reply to contacts
Delivery under the sending service's terms
How the list changes
- Every addition or replacement is notified with at least thirty days' notice.
- You may object on documented grounds within fifteen days of the notification.
- If no workable alternative exists, you may withdraw from the affected service without penalty.
- The register is reviewed at least once a year and at every change.
Why categories and not names
By choice, we do not publish the names of the artificial intelligence suppliers on the site. The full contractual register, with names, actual locations, retention and transfer mechanisms, is part of the documentation delivered before signing, together with the data processing agreement.
To receive the full register, write to info@kartio.ai.